Merge "qcacmn: Fix OOB issue in wlan_parse_rsn_ie" (d494ff9a) · Commits · e / devices / android_kernel_fairphone_FP4

umac/cmn_services/cmn_defs/inc/wlan_cmn_ieee80211.h

+2 −1

Original line number	Original line	Diff line number	Diff line
	@@ -1649,7 +1649,8 @@ static inline QDF_STATUS wlan_parse_rsn_ie(uint8_t *rsn_ie,
	rsn->pmkid_count = LE_READ_2(ie);		rsn->pmkid_count = LE_READ_2(ie);
	ie += 2;		ie += 2;
	rem_len -= 2;		rem_len -= 2;
	if (rsn->pmkid_count > (unsigned int) rem_len / PMKID_LEN) {		if (rsn->pmkid_count > MAX_PMKID \|\|
			rsn->pmkid_count > (unsigned int)rem_len / PMKID_LEN) {
	rsn->pmkid_count = 0;		rsn->pmkid_count = 0;
	return QDF_STATUS_E_INVAL;		return QDF_STATUS_E_INVAL;
	}		}