tree 76906fe38868f86d06e15c376d03c7f8bf237d99
parent 856c103e509e04287dd7633b5b7fdfda48e54f53
author Ashish Kumar Dhanotiya <adhanoti@codeaurora.org> 1581425086 +0530
committer Gerrit - the friendly Code Review server <code-review@localhost> 1581425469 -0800

wlan: Validate assoc response IE len before copy

When host sends assoc response to supplicant, it
allocates a buffer of fixed size and copies a variable
length of assoc response IEs to this fixed sized buffer.
There is a possibility of OOB write to the allocated buffer
if the assoc response IEs length is greater than the
allocated buffer size.
To avoid above issue validate the assoc response IEs length
with the allocated buffer size before data copy to the buffer.

Change-ID: Ib12385e9ff04e5172ae8b505faf959e426fda439
CRs-Fixed: 2616226