qcacmn: Fix possible OOB in extract_ocb_dcc_stats_tlv
The correct element number of param_tlvs->stats_per_channel_list is actually param_tlvs->num_stats_per_channel_list and thus the qdf_mem_copy() can actually copy more bytes than are in the buffer causing a buffer overread. Fix it by checking fix_param->num_channels against the actually param_tlvs->num_stats_per_channel_list before doing memory copy. Change-Id: I610920ac1d0a927a52de83935616e8e8fdfec7e7 CRs-Fixed: 2428212
Loading
Please register or sign in to comment