Don't account length field size while comparing against max beacon size. Current driver starts from (ptr+4 bytes) then tries to copy 512 bytes from that point which creates to copy extra 4 bytes beyond the array's boundary. Instead copy only 508 bytes if driver starts copying from (ptr+ 4bytes). ptr ^ | | +---------------+--------------------------------+ | | | | Length | Max Beacon payload | | | | +---------------+--------------------------------+ |<-- 4 bytes -->|<-------- 508 bytes ----------->| |<------------- 512 bytes --------------------->| CRs-Fixed: 2327052 Change-Id: I2646986ec424f7da31107ad01f673588734eaa52 |
||
---|---|---|
.. | ||
bmi | ||
cds | ||
dp | ||
hdd | ||
mac | ||
pld | ||
sap | ||
sme | ||
wma |