tree 63e67d80ff2da9bc0d6414fa325a443b7b868e5d
parent f029d0d424d327535f5c4f8a2af1c8e26a48adb3
author yang-cy.chen <yang-cy.chen@mediatek.com> 1452740265 +0800
committer Jin Qian <jinqian@google.com> 1452824354 +0000

Fix "[Security Vulnerability]mt_wifi IOCTL_GET_STRUCT EOP" issue

Problem:
prNdisReq->ndisOidContent is in a static allocation of size 0x1000,
and prIwReqData->data.length is a usermode controlled unsigned short
,so the copy_from_user results in memory corruption.

Solution:
Add boundary protection to prevent buffer overflow

Bug num:26267358

Change-Id: I70f9d2affb9058e2e80b6b9f8278d538186283d3
Signed-off-by: yang-cy.chen <yang-cy.chen@mediatek.com>
(cherry picked from commit 9c112c7344a2642a6e7ee29ee920900248a29e8a)