commit 0c6cd801dc3a92aa31d10514a8d855463bd7fee5
author sheenam monga <shebala@codeaurora.org> Mon Jun 17 17:35:51 2019 +0530
committer nshrivas <nshrivas@codeaurora.org> Tue Jun 25 13:06:48 2019 -0700
tree 52441e932f835e4322c415f625d7e11f6e6fece8
parent a6c047026d311c0ab2c2ad295388249320409c99

qcacmn: Fix OOB in send_gtk_offload_cmd_tlv

In current design, Host driver copies kck and kek from pmo_gtk_req
to kck and kek of WMI_GTK_OFFLOAD_CMD_fixed_param. Host tries
to copy PMO_KCK_LEN i.e 32 bytes to an array of length 16 bytes
which can lead to OOB.

Fix is to copy only 16 bytes of kck and kek. Copy the bytes
from pmo_gtk_req same as the size of cmd->kck and cmd->kek i.e
destination array size to avoid OOB.

Change-Id: I999add18e18bedc9cfa1a0cfa5c0dad781e8e13f
CRs-Fixed: 2470368