tree 6bd8c0f3962184b31fe9e3a4d62d1d6f2cb10f10
parent b53da9a7e0ea50edf477cbc7412fe1efaadf1cfb
author Deeksha Gupta <deegupta@codeaurora.org> 1633405650 +0530
committer Gerrit - the friendly Code Review server <code-review@localhost> 1633429964 -0700

wlan: Fix possible OOB in unpack_tlv_core

Currently in UnpackTlvCore(), nBufRemaining is validated
after calling framesntohs API. Since, framesntohs() copies
pIn address to pOut address with length = 2 bytes as below.
DOT11F_MEMCPY(pCtx, (uint16_t *)pOut, pIn, 2);
which could cause OOB issue if pIn contains less than 2 bytes.

Fix is to validate the nBufRemaining size before calling
framesntohs().

Change-Id: Ia79a590efaa0d81f06eb66c2163da34f1932b18f
CRs-Fixed: 3048959