Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4ff5ad06 authored by Linux Build Service Account's avatar Linux Build Service Account Committed by Gerrit - the friendly Code Review server
Browse files

Merge "qcacmn: Fix potential oob issue in wlan_parse_wapi_ie()"

parents 530942ae 54e92ccc
Loading
Loading
Loading
Loading
+3 −0
Original line number Diff line number Diff line
@@ -1994,9 +1994,12 @@ static inline void wlan_parse_wapi_ie(uint8_t *wapi_ie,
		len -= WLAN_OUI_SIZE;
	}

	if (len < 2)
		return;
	wapi->uc_cipher_count = LE_READ_2(ie);
	ie += 2;
	len -= 2;

	if ((wapi->uc_cipher_count > WLAN_MAX_CIPHER) ||
	   len < (wapi->uc_cipher_count * WLAN_OUI_SIZE + 2))
		return;