qcacld-2.0: Fix potential OOB read in lim_parse_kde_elements

Propagation from cld3.0 to cld2.0.
In function lim_parse_kde_elements, while parsing the KDE list from
the assoc response frame, elem_len is obtained from the frame buffer.
elem_len is then used to find the matching OUI for KDE OUI type and
then to calculate data_len based on the offset for the GTK/IGTK data
types.

If the value in elem_len field in the frame is less than the Data
Offset (which includes the OUI and data type) or the GTK/IGTK offset
then a OOB read would occur.

Add checks to validate the elem_len with Data offset and then with
the GTK/IGTK offset based on the data type.

Change-Id: I8ae31c6d6c28e88ad9bda757b3f1ff2585f8a553
CRs-Fixed: 2203857

0 files changed, 0 insertions, 0 deletions