qcacld-3.0: Avoid info leak in spectral scan handler
In __spectral_scan_msg_handler(), payload section of input data is type casted to driver internal structure spectral_scan_msg without validating payload length which can lead to kernel info leak if the payload length is less than size of spectral_scan_msg. To fix this, avoid type-cast and return error if payload length is less than size of spectral_scan_msg. Change-Id: Ie7e74cc2cdcf8136582e81ffc3a088fd5a881dc9 CRs-Fixed: 2468493
Loading
Please register or sign in to comment