Validate buffer room for feature flags from the driver
Add an explicit check to avoid buffer overflow while copying data from
attributes sent by the driver should the driver return an unexpectedly
long set of feature flags.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
diff --git a/sta.c b/sta.c
index 2bf121d..335a6b7 100644
--- a/sta.c
+++ b/sta.c
@@ -7389,7 +7389,7 @@
if (attr) {
int len = nla_len(attr);
- if (info && info->flags && len >= 0) {
+ if (info && info->flags && len <= sizeof(info->flags)) {
memcpy(info->flags, nla_data(attr), len);
info->flags_len = len;
}