Currently in the function lim_process_action_vendor_specific, mem_cmp is done on the received frame pointer without validating the frame_len which could lead to out-of-bounds memory access if the frame_len is not matching the size of action_hdr. Add check to validate the frame_len with action_hdr size before doing mem_cmp for the p2p oui. Change-Id: I39329d1a9ef45614d3c617db11a7a7f5ec2aaaec CRs-Fixed: 2101439 |
||
---|---|---|
.. | ||
bmi | ||
cds | ||
dp | ||
hdd | ||
mac | ||
pld | ||
sap | ||
sme | ||
wma |