From 825d21edcb0dce2417da51cd881dc0ef5c5334ad Mon Sep 17 00:00:00 2001 From: Surya Prakash Sivaraj Date: Fri, 1 Dec 2023 10:16:57 +0530 Subject: [PATCH] qcacmn: Add sanity check to fix OOB issue Add sanity check to fix OOB issue while generating scan entries for beacon CRs-Fixed: 3591858 Change-Id: I35b362bc89ab10fa2d2d6660263c726692384e07 --- umac/scan/dispatcher/src/wlan_scan_utils_api.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/umac/scan/dispatcher/src/wlan_scan_utils_api.c b/umac/scan/dispatcher/src/wlan_scan_utils_api.c index 49be228eac36..bff9e3b812c4 100644 --- a/umac/scan/dispatcher/src/wlan_scan_utils_api.c +++ b/umac/scan/dispatcher/src/wlan_scan_utils_api.c @@ -2642,9 +2642,9 @@ util_scan_parse_beacon_frame(struct wlan_objmgr_pdev *pdev, mbssid_ie = util_scan_find_ie(WLAN_ELEMID_MULTIPLE_BSSID, (uint8_t *)&bcn->ie, ie_len); if (mbssid_ie) { - if (mbssid_ie[1] <= 0) { + if (mbssid_ie[TAG_LEN_POS] < VALID_ELEM_LEAST_LEN) { scm_debug("MBSSID IE length is wrong %d", - mbssid_ie[1]); + mbssid_ie[TAG_LEN_POS]); return status; } qdf_mem_copy(&mbssid_info.trans_bssid,