commit 09d8b7d262ea16cfebfdd2a8f042832d4995e0d3
author lifeng <lifeng@codeaurora.org> Thu Dec 07 12:56:18 2017 +0800
committer Anjaneedevi Kapparapu <akappara@codeaurora.org> Thu Feb 01 15:22:39 2018 +0530
tree d4c8d26255e0a05e0f912e199b3866e64c1a46a4
parent 489533724b999c20603b1726758d0057a5badd4c

qcacld-2.0: Add buffer size check in cfg_get_vendor_ie_ptr_from_oui

Add buffer size check in cfg_get_vendor_ie_ptr_from_oui before
comparing the OUI in IE buffer with the given OUI in case of
out of band issue.

Change-Id: I632c18fb1f18a56ee618596982da2acc19890dac
CRs-Fixed: 2150456

CORE/MAC/src/cfg/cfgApi.c

diff --git a/CORE/MAC/src/cfg/cfgApi.c b/CORE/MAC/src/cfg/cfgApi.c
index e3f51ac..84ee3ac 100644
--- a/CORE/MAC/src/cfg/cfgApi.c
+++ b/CORE/MAC/src/cfg/cfgApi.c
@@ -1132,8 +1132,9 @@
 			return NULL;
 		}
 		if (SIR_MAC_EID_VENDOR == elem_id) {
-			if(memcmp(&ptr[2], oui, oui_size)==0)
-			return ptr;
+			if((elem_len>=oui_size) &&
+				(memcmp(&ptr[2], oui, oui_size)==0))
+				return ptr;
 		}
 
 		left -= elem_len;