wlan: Fix OOB read in limProcessDeauthFrame
Propagation from cld2.0 to prima In the API limProcessDeauthFrame, the reason-code is fetched from the payload, and it may happen that the payload received is empty, and the MPDU just contains the header, so the driver may access the memory not allocated to the frame, thus resulting in a OOB read. Fix is to have a min length check of 16 bits for the reason code before accessing it. Change-Id: I7e7a435ba049356c13fb10240f4abb9bf6219af4 CRs-Fixed: 2341590
Loading
Please register or sign in to comment