commit | 1cca2e2702b41ec94529f446f7c7482d881d68e0 | [log] [tgz] |
---|---|---|
author | Deeksha Gupta <deegupta@codeaurora.org> | Tue Oct 05 09:17:30 2021 +0530 |
committer | Gerrit - the friendly Code Review server <code-review@localhost> | Tue Oct 05 03:32:44 2021 -0700 |
tree | 6bd8c0f3962184b31fe9e3a4d62d1d6f2cb10f10 | |
parent | b53da9a7e0ea50edf477cbc7412fe1efaadf1cfb [diff] |
wlan: Fix possible OOB in unpack_tlv_core Currently in UnpackTlvCore(), nBufRemaining is validated after calling framesntohs API. Since, framesntohs() copies pIn address to pOut address with length = 2 bytes as below. DOT11F_MEMCPY(pCtx, (uint16_t *)pOut, pIn, 2); which could cause OOB issue if pIn contains less than 2 bytes. Fix is to validate the nBufRemaining size before calling framesntohs(). Change-Id: Ia79a590efaa0d81f06eb66c2163da34f1932b18f CRs-Fixed: 3048959