commit | aebc55dc3241a0e04d439ad4170d902d7d5b9f0e | [log] [tgz] |
---|---|---|
author | Deeksha Gupta <deegupta@codeaurora.org> | Thu Oct 14 16:23:01 2021 +0530 |
committer | Gerrit - the friendly Code Review server <code-review@localhost> | Mon Dec 06 03:38:20 2021 -0800 |
tree | 27f4ddec1877015e262bd70939e8db78b57a5f89 | |
parent | a5c8c6b77e8bb4e6225c3f06a76f64b1caa4853d [diff] |
wlan: Fix possible OOB in UnpackTlvCore Currently in UnpackTlvCore(), nBufRemaining is validated after calling framesntohs API. Since, framesntohs() copies pIn address to pOut address with length = 2 bytes as below. DOT11F_MEMCPY(pCtx, (uint16_t *)pOut, pIn, 2); which could cause OOB issue if pIn contains less than 2 bytes. Fix is to validate the nBufRemaining size before calling framesntohs(). Change-Id: I192dd5b0c68813d01b47011f490d6099049bcda3 CRs-Fixed: 3056532