qcacmn: Fix possible OOB access while sending ext stats request
In 32-bit systems, currently there is possible oob access in send_stats_ext_req_cmd_tlv() is preq->request_data_len is uin32_t max and len is also of type uint32_t. Fix possible OOB access while sending ext stats request message to firmware by validating the requested data length against the difference between wmi max message size(WMI_SVC_MSG_MAX_SIZE), size of the wmi command fixed param and wmi tlv header size WMI_TLV_HDR_SIZE. Change-Id: I769c9a6b7c0e0f76e2ec1070cac6c69768816454 CRs-Fixed: 2724256
Loading
Please register or sign in to comment