wcnss: validate build version response correctly



Build version response contains smd_msg_hdr also,
so validate build version response length by
considering the size of smd_msg_hdr.

Change-Id: I538ea8bfd1ab8cab1c128fb3f628ba70f08860be
CRs-Fixed: 2716972
Signed-off-by: Dundi Raviteja <dundi@codeaurora.org>

parent e60bc8ba

drivers/soc/qcom/wcnss/wcnss_wlan.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -2291,8 +2291,8 @@ static void wcnss_process_smd_msg(void *buf, int len)
		break;

		case WCNSS_BUILD_VER_RSP:
		/* ToDo: WCNSS_MAX_BUILD_VER_LEN + sizeof(struct smd_msg_hdr) */
		if (len > WCNSS_MAX_BUILD_VER_LEN) {
		if (len > sizeof(struct smd_msg_hdr) +
		WCNSS_MAX_BUILD_VER_LEN) {
		wcnss_log(ERR,
		"invalid build version:%d\n", len);
		return;