tree 27f4ddec1877015e262bd70939e8db78b57a5f89
parent a5c8c6b77e8bb4e6225c3f06a76f64b1caa4853d
author Deeksha Gupta <deegupta@codeaurora.org> 1634208781 +0530
committer Gerrit - the friendly Code Review server <code-review@localhost> 1638790700 -0800

wlan: Fix possible OOB in UnpackTlvCore

Currently in UnpackTlvCore(), nBufRemaining is validated
after calling framesntohs API. Since, framesntohs() copies
pIn address to pOut address with length = 2 bytes as below.
DOT11F_MEMCPY(pCtx, (uint16_t *)pOut, pIn, 2);
which could cause OOB issue if pIn contains less than 2 bytes.

Fix is to validate the nBufRemaining size before calling
framesntohs().

Change-Id: I192dd5b0c68813d01b47011f490d6099049bcda3
CRs-Fixed: 3056532