qcacld-3.0: Fix potential buffer over-read during FILS Association
In function wlan_hdd_send_roam_auth_event, FILS kek is copied to
skb for the vendor command QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_PTK_KEK
for kek_len length. There is no validation for the max value of
kek_len and would lead to an buffer over-read if kek_len exceeds
SIR_KEK_KEY_LEN_FILS.
Add sanity check for kek_len for max limit SIR_KEK_KEY_LEN_FILS
before copying the kek to skb.
Change-Id: I4290909cd2df8686a32d25aa14711db2b899b2eb
CRs-Fixed: 2152985
1 file changed