Merge "qcacld-3.0: Invalid rem_len computation in roam stats evt handler" into...

Merge "qcacld-3.0: Invalid rem_len computation in roam stats evt handler" into wlan-cld3.driver.lnx.2.0.r18

core/wma/src/wma_scan_roam.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -3786,7 +3786,7 @@ int wma_roam_stats_event_handler(WMA_HANDLE handle, uint8_t *event,
		num_tlv = MAX_ROAM_SCAN_STATS_TLV;
		}

		rem_len = WMI_SVC_MSG_MAX_SIZE - sizeof(*fixed_param);
		rem_len = len - sizeof(*fixed_param);
		if (rem_len < num_tlv * sizeof(wmi_roam_trigger_reason)) {
		wma_err_rl("Invalid roam trigger data");
		goto err;