From ff252beffabddae7570280c407eada4cb667df16 Mon Sep 17 00:00:00 2001
From: Ashish Kumar Dhanotiya <adhanoti@codeaurora.org>
Date: Wed, 14 Jun 2017 18:06:01 +0530
Subject: [PATCH] qcacld-3.0: Resolve out of bound memory access while
 processing VSIEs

Currently elem_len is not checked against WPS_OUI_TYPE_SIZE
before it uses the buffer for memcmp, this may cause the buffer
overread.

To fix this add the proper comparision logic before the API uses
the buffer.

Change-Id: I9ba63543a529fb88932500be39045fcc19509863
CRs-Fixed: 2061159
---
 core/hdd/src/wlan_hdd_hostapd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/core/hdd/src/wlan_hdd_hostapd.c b/core/hdd/src/wlan_hdd_hostapd.c
index b7357f1508d4..baddba974f5f 100644
--- a/core/hdd/src/wlan_hdd_hostapd.c
+++ b/core/hdd/src/wlan_hdd_hostapd.c
@@ -6688,7 +6688,7 @@ static void wlan_hdd_add_hostapd_conf_vsie(hdd_adapter_t *pHostapdAdapter,
 		elem_id = ptr[0];
 		elem_len = ptr[1];
 		left -= 2;
-		if (elem_len > left) {
+		if (elem_len > left || elem_len < WPS_OUI_TYPE_SIZE) {
 			hdd_err("**Invalid IEs eid: %d elem_len: %d left: %d**",
 				elem_id, elem_len, left);
 			return;