tree de7f06bddfd498f2c6eca0478ab5eb9750695482
parent d74adafded9ceb57fca7012ae1e24d512dd8dcb6
author qize wang <wangqize888888888@gmail.com> 1575022254 +0800
committer Greg Kroah-Hartman <gregkh@linuxfoundation.org> 1578827510 +0100

mwifiex: Fix heap overflow in mmwifiex_process_tdls_action_frame()

[ Upstream commit 1e58252e334dc3f3756f424a157d1b7484464c40 ]

mwifiex_process_tdls_action_frame() without checking
the incoming tdls infomation element's vality before use it,
this may cause multi heap buffer overflows.

Fix them by putting vality check before use it.

IE is TLV struct, but ht_cap and  ht_oper aren’t TLV struct.
the origin marvell driver code is wrong:

memcpy(&sta_ptr->tdls_cap.ht_oper, pos,....
memcpy((u8 *)&sta_ptr->tdls_cap.ht_capb, pos,...

Fix the bug by changing pos(the address of IE) to
pos+2 ( the address of IE value ).

Signed-off-by: qize wang <wangqize888888888@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>