Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d5f37fc6 authored by Abhinav Kumar's avatar Abhinav Kumar
Browse files

prima: Reset Maximum allowable size of a beacon frame

While updating probe response template, driver uses
probeRespTemplateLen as the maximum allowable size of beacon frame.
In case if the content of probeRespTemplateLen is greater than
SCH_MAX_PROBE_RESP_SIZE (700) results in Buffer Overflow while
copying probeRespTemplate buffer to local buffer.

Fix is to validate probeRespTemplateLen against maximum allowable
size (SCH_MAX_PROBE_RESP_SIZE) and if probeRespTemplateLen is
greater than maximum then reset to SCH_MAX_PROBE_RESP_SIZE.

Change-Id: Iccc8e63c78b104d0c2ba5a6995e72c47ac8f8e25
CRs-Fixed: 2303693
parent 919fd66e
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment