diff options
| author | Jingxiang Ge <jge@codeaurora.org> | 2018-10-23 17:38:21 +0800 |
|---|---|---|
| committer | Kelly Rossmoyer <krossmo@google.com> | 2019-05-09 23:17:03 +0000 |
| commit | 0da2144509ad97742e3319a3771cc0425d79c4d0 (patch) | |
| tree | cae24f794698ccdac2b45ee04858ad70c33a8a23 /net/lapb/lapb_timer.c | |
| parent | 29f93f41df52f0ba54f27aa643bcf01f3d7f55f6 (diff) | |
qcacld-2.0: Fix possible integer underflow in cfg80211_rx_mgmt
propagation from qcacld-3.0 to qcacld-2.0
In the function cfg80211_rx_mgmt, data_len is calculated as
len - ieee80211_hdrlen(mgmt->frame_control). Len is not
validated before this calculation. So a possible integer
underflow will occur if len value is less than the value of
ieee80211_hdrlen(mgmt->frame_control).
Validate the value of len against
ieee80211_hdrlen(mgmt->frame_control) in the caller.
Bug: 129850941
Change-Id: Iae776daf37b0c052bd4ce4da44ea728d121eae51
CRs-Fixed: 2337425
Signed-off-by: hsuvictor <hsuvictor@google.com>
Diffstat (limited to 'net/lapb/lapb_timer.c')
0 files changed, 0 insertions, 0 deletions