commit bd8e0f6227576a20b9293a98eac69b888fcd6469
author Nishank Aggarwal <naggar@codeaurora.org> Fri Feb 10 15:48:13 2017 +0530
committer Gerrit - the friendly Code Review server <code-review@localhost> Mon Feb 20 06:43:12 2017 -0800
tree 11f09c6d3f497b1ace87ebfbe816ad3ac3a18c6f
parent b8c53aac886e58b7a44c98dcb3e38977f18fdf28

wlan: Fix buffer overflow in WLANSAP_Set_WPARSNIes()

qcacld-2.0 to prima propagation

Currently In WLANSAP_Set_WPARSNIes() the parameter WPARSNIEsLen
is user-controllable and never validates which uses as the length
for a memory copy. This enables user-space applications to corrupt
heap memory and potentially crash the kernel.

Fix is to validate the WPARSNIes length to its max before use as the
length for a memory copy.

Change-Id: I7aff731aeae22bfd84beb955439a799abef37f68
CRs-Fixed: 1102648