qcacld-3.0: Fix OOB access in __iw_set_scan()

In function __iw_set_scan(), copying data to addIEdata buffer
without checking the length of source buffer. which may lead to
out of buffer access.

Also, pAdapter is dereferenced without checking for NULL while
initializing hdd_ctx and pwextBuf variables, which may lead to
NULL pointer dereference.

To address OOB access, check genIE length against
SIR_MAC_MAX_ADD_IE_LENGTH + 2 and to fix NULL pointer dereference
first check pAdapter for NULL and then assign hdd_ctx and pwextBuf
variables.

Change-Id: I84e8c6a574e73f816926295076e12e0348d481c0
CRs-Fixed: 2260112

0 files changed, 0 insertions, 0 deletions