Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2bc32f25 authored by Linux Build Service Account's avatar Linux Build Service Account Committed by Gerrit - the friendly Code Review server
Browse files

Merge "qcacld-3.0: Fix integer overflow in rrm_fill_beacon_ies()" into... 

Merge "qcacld-3.0: Fix integer overflow in rrm_fill_beacon_ies()" into wlan-cld3.driver.lnx.1.1.r61-rel
parents 09e82e29 0aa702fc

core/mac/src/pe/rrm/rrm_api.c

+10 −3
Original line number Diff line number Diff line
@@ -745,12 +745,19 @@ rrm_fill_beacon_ies(tpAniSirGlobal pMac, 
	}



	while (BcnNumIes > 0) {

		len = *(pBcnIes + 1) + 2;       /* element id + length. */

		len = *(pBcnIes + 1);

		len += 2;       /* element id + length. */

		pe_debug("EID = %d, len = %d total = %d",

			*pBcnIes, *(pBcnIes + 1), len);



		if (!len) {

			pe_err("Invalid length");

		if (BcnNumIes < len) {

			pe_err("RRM: Invalid IE len:%d exp_len:%d",

			       len, BcnNumIes);

			break;

		}



		if (len <= 2) {

			pe_err("RRM: Invalid IE");

			break;

		}