tree f3c8fe81bb9ac9a73a3f21b9369a9b72155bf3bc
parent a36e9eb08461d9c4d7b87248ef39f59ab4181ba6
author Vignesh Viswanathan <viswanat@codeaurora.org> 1524208884 +0530
committer Gerrit - the friendly Code Review server <code-review@localhost> 1525147989 -0700

qcacld-3.0: Add sanity check for kek_len and pmk_len in WMA roam synch

In wma_fill_roam_synch_buffer, fils_info is received from the FW
as part of roam synch event and contains kek_len and pmk_len. These
lengths are used to copy the kek and pmk from the FW buffer to the
roam_synch_ind_ptr respectively.

If the kek_len exceeds the SIR_KEK_KEY_LEN_FILS or pmk_len exceeds
the SIR_PMK_LEN value, a buffer overwrite would occur during
memcpy.

Add sanity check to return error if kek_len exceeds SIR_KEK_KEY_LEN_FILS
or if pmk_len exceeds SIR_PMK_LEN.

Change-Id: I8035c54cb4cbd5b4065646377f7d1d2824f9c436
CRs-Fixed: 2226386