In __wlan_hdd_cfg80211_scan(), while copying ie data from cfg80211_scan_request to local destination buffer, there is no check of ie_len against maximum possible length of SIR_MAC_MAX_ADD_IE_LENGTH (2048). This can result in buffer over-flow. To address this, validate ie_len in cfg80211_scan_request. Change-Id: I5da837395869704666762fdf57293d9561d3ad83 CRs-Fixed: 2247604 |
||
---|---|---|
.. | ||
inc | ||
src |