qcacmn: Fix OOB issue in wlan_parse_rsn_ie
Issue: Currently, host doesn't validate pkid_count before populating data in rsn->pmkid. rsn->pmkid array can store only 4/MAX_PMKID pmkids which may cause OOB write if host tries to copy pmkids more than MAX_PMKID. Fix: validate pkid_count before populating rsn->pmkid and return Failure in case pkid_count becomes greater than MAX_PMKID to avoid OOB. Change-Id: I211ea791a52ecb84872d139929f999a89db240d5 CRs-Fixed: 2724407
Loading
Please register or sign in to comment