diff options
| author | hqu <hqu@codeaurora.org> | 2019-02-27 16:28:52 +0800 |
|---|---|---|
| committer | hqu <hqu@codeaurora.org> | 2019-02-27 16:32:35 +0800 |
| commit | 1189c189ea1d095d3651f77330f22d9426860a4f (patch) | |
| tree | b4d70405b9b0a1d38f5fffbb6459d61cf0fe8a65 /tools/perf/scripts/python/cs-trace-disasm.py | |
| parent | 8fe5ad91d56a531b83d70ba1232df8623a88b30c (diff) | |
qcacld-2.0: Fix possible OOB in limProcessAssocReqFrame
propagation from qcacld-3.0 to qcacld-2.0
In the function limProcessAssocReqFrame, if wpa IE is
present, then dot11fUnpackIeWPA is called to copy the wpa IE
to destination buffer. pAssocReq->wpa.length is passed as the
length to copy the IE. As this length includes 4 bytes of the
OUI fields also, this could result in OOB read.
Change the length passed to the dot11fUnpackIeWPA as
(pAssocReq->wpa.length - 4), so that the additional 4 bytes of
the OUI fields are excluded.
Change-Id: If972b3a19d239bb955c7b4d4c7d94e25aa878f21
CRs-Fixed: 2406159
Diffstat (limited to 'tools/perf/scripts/python/cs-trace-disasm.py')
0 files changed, 0 insertions, 0 deletions