In find_ie_defn function, if the current IE is an Ext IE with EID=255, the third byte of the IE is accessed to get the extn_eid. However, if the actual buffer length is less than 3, then an OOB read would occur while trying to access extn_eid. Add check to access pbuf + 2 for extn_eid only if nbuf is greater than 2. Change-Id: Id9708176affe35a85eb21a07901ae8ed62b78b9e CRs-Fixed: 2237141 |
||
---|---|---|
.. | ||
inc | ||
src |