diff options
| author | Linux Build Service Account <lnxbuild@localhost> | 2021-11-02 05:59:06 -0700 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2021-11-02 05:59:06 -0700 |
| commit | 2ada1fef12f147a9ac15d0b4c7a71be9fd0477b1 (patch) | |
| tree | 19de35cd0bf47f47393ef3df657c2820387109cf | |
| parent | b88e05e1321b1c67585d23de006d6dfa403db239 (diff) | |
| parent | b348a1d2e87cb54266660d53d590fa89c9747368 (diff) | |
Merge "qcacld-3.0: Avoid OOB read in dot11f_unpack_assoc_response"
| -rw-r--r-- | core/mac/src/sys/legacy/src/utils/src/dot11f.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/core/mac/src/sys/legacy/src/utils/src/dot11f.c b/core/mac/src/sys/legacy/src/utils/src/dot11f.c index 8325550d3460..55781cf9a8e0 100644 --- a/core/mac/src/sys/legacy/src/utils/src/dot11f.c +++ b/core/mac/src/sys/legacy/src/utils/src/dot11f.c @@ -335,7 +335,7 @@ static uint32_t get_container_ies_len(tpAniSirGlobal pCtx, len += *(pBufRemaining+1); pBufRemaining += len + 2; len += 2; - while (len < nBuf) { + while (len + 1 < nBuf) { pIe = find_ie_defn(pCtx, pBufRemaining, nBuf - len, IEs); if (NULL == pIe) break; |