A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-26 06:33:19 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix buffer overread in get oui vendor command

Browse source 
qcacld-2.0 to qcacld-3.0 Propagation.

In get oui ie command API, ie pointer read out
of boundary.

Return NULL if ie length is less than oui size.

CRs-Fixed: 2053002
Change-Id: I13375d3bfa472eda25d8d6191431dd1f79bf5842
This commit is contained in:
SaidiReddy Yenuga 2017-05-26 18:34:23 +05:30 • committed by snandini
commit ecb273bc6e
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
core/hdd/src/wlan_hdd_wext.c
View file

@ -4001,7 +4001,7 @@ uint8_t *wlan_hdd_get_vendor_oui_ie_ptr(uint8_t *oui, uint8_t oui_size,
eid, elem_len, left);
return NULL;
}
if (elem_id == eid) {
if ((elem_id == eid) && (elem_len >= oui_size)) {
if (memcmp(&ptr[2], oui, oui_size) == 0)
return ptr;
}