qcacmn: Fix possible overread in wifi_pos_parse_req
In wifi_pos_parse_req(), payload sections of nl attributes ATTR_DATA and ATTR_META_DATA are type casted to driver internal structures tAniMsgHdr and wifi_pos_field_info respectively without validating payload lengths which can lead to buffer overread if the payload lengths are less than size of internal structures. To fix this, avoid type-cast and return error if payload lengths of nl attributes ATTR_DATA and ATTR_META_DATA are less than size of tAniMsgHdr and wifi_pos_field_info respectively. Change-Id: Ie9e3197f2cd3852b394e834991aa8d3a5b530d85 CRs-Fixed: 2471275
Loading
Please register or sign in to comment