From ecb273bc6e59a41f3c23412032d1c4f96f79591b Mon Sep 17 00:00:00 2001
From: SaidiReddy Yenuga <saidir@codeaurora.org>
Date: Fri, 26 May 2017 18:34:23 +0530
Subject: [PATCH] qcacld-3.0: Fix buffer overread in get oui vendor command

qcacld-2.0 to qcacld-3.0 Propagation.

In get oui ie command API, ie pointer read out
of boundary.

Return NULL if ie length is less than oui size.

CRs-Fixed: 2053002
Change-Id: I13375d3bfa472eda25d8d6191431dd1f79bf5842
---
 core/hdd/src/wlan_hdd_wext.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/core/hdd/src/wlan_hdd_wext.c b/core/hdd/src/wlan_hdd_wext.c
index ec8b0ed427b0..2a67e2fa60e2 100644
--- a/core/hdd/src/wlan_hdd_wext.c
+++ b/core/hdd/src/wlan_hdd_wext.c
@@ -4001,7 +4001,7 @@ uint8_t *wlan_hdd_get_vendor_oui_ie_ptr(uint8_t *oui, uint8_t oui_size,
 				eid, elem_len, left);
 			return NULL;
 		}
-		if (elem_id == eid) {
+		if ((elem_id == eid) && (elem_len >= oui_size)) {
 			if (memcmp(&ptr[2], oui, oui_size) == 0)
 				return ptr;
 		}