commit 70665a2f99f1d71238f338b3e6740fa753f4cd7e
author yang-cy.chen <yang-cy.chen@mediatek.com> Thu Jan 14 10:57:45 2016 +0800
committer Jin Qian <jinqian@google.com> Fri Jan 15 02:19:14 2016 +0000
tree 63e67d80ff2da9bc0d6414fa325a443b7b868e5d
parent f029d0d424d327535f5c4f8a2af1c8e26a48adb3

Fix "[Security Vulnerability]mt_wifi IOCTL_GET_STRUCT EOP" issue

Problem:
prNdisReq->ndisOidContent is in a static allocation of size 0x1000,
and prIwReqData->data.length is a usermode controlled unsigned short
,so the copy_from_user results in memory corruption.

Solution:
Add boundary protection to prevent buffer overflow

Bug num:26267358

Change-Id: I70f9d2affb9058e2e80b6b9f8278d538186283d3
Signed-off-by: yang-cy.chen <yang-cy.chen@mediatek.com>
(cherry picked from commit 9c112c7344a2642a6e7ee29ee920900248a29e8a)