| commit | c202f3ef17802d25455e287421bf2e04ad22c222 | [log] [tgz] |
|---|---|---|
| author | Deeksha Gupta <deegupta@codeaurora.org> | Thu Oct 14 16:23:01 2021 +0530 |
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | Mon Nov 08 01:49:22 2021 -0800 |
| tree | 52b561f047efccfdc7b40260ec32212eaa1e91f3 | |
| parent | b78da1639f8945941912975c0761459753b5c2b4 [diff] |
wlan: Fix possible OOB in UnpackTlvCore Currently in UnpackTlvCore(), nBufRemaining is validated after calling framesntohs API. Since, framesntohs() copies pIn address to pOut address with length = 2 bytes as below. DOT11F_MEMCPY(pCtx, (uint16_t *)pOut, pIn, 2); which could cause OOB issue if pIn contains less than 2 bytes. Fix is to validate the nBufRemaining size before calling framesntohs(). Change-Id: I192dd5b0c68813d01b47011f490d6099049bcda3 CRs-Fixed: 3056532