~hc/RK356X_SDK_RELEASE.git

..	..	@@ -1918,15 +1918,13 @@
1918	1918
1919	1919	switch (pIE->ElementID) {
1920	1920	case _SUPPORTEDRATES_IE_:
1921		- if (pIE->Length <= sizeof(supportRate)) {
1922		- _rtw_memcpy(supportRate, pIE->data, pIE->Length);
1923		- supportRateNum = pIE->Length;
1924		- }
	1921	+ _rtw_memcpy(supportRate, pIE->data, pIE->Length);
	1922	+ supportRateNum = pIE->Length;
1925	1923	break;
1926	1924	case _COUNTRY_IE_:
1927	1925	break;
1928	1926	case _EXT_SUPPORTEDRATES_IE_:
1929		- if ((supportRateNum + pIE->Length) <= sizeof(supportRate)) {
	1927	+ if (supportRateNum < sizeof(supportRate)) {
1930	1928	_rtw_memcpy(supportRate + supportRateNum, pIE->data, pIE->Length);
1931	1929	supportRateNum += pIE->Length;
1932	1930	}
..	..	@@ -1937,19 +1935,17 @@
1937	1935	rsnie_included = 1;
1938	1936	if (prx_pkt_attrib->encrypt) {
1939	1937	prsnie = (u8 *)pIE;
1940		- if (pIE->Length <= sizeof(ptdls_sta->TDLS_RSNIE)) {
1941		- /* Check CCMP pairwise_cipher presence. */
1942		- ppairwise_cipher = prsnie + 10;
1943		- _rtw_memcpy(ptdls_sta->TDLS_RSNIE, pIE->data, pIE->Length);
1944		- pairwise_count = (u16 )(ppairwise_cipher - 2);
1945		- for (k = 0; k < pairwise_count; k++) {
1946		- if (_rtw_memcmp(ppairwise_cipher + 4 * k, RSN_CIPHER_SUITE_CCMP, 4) == _TRUE)
1947		- ccmp_included = 1;
1948		- }
1949		-
1950		- if (ccmp_included == 0)
1951		- txmgmt.status_code = _STATS_INVALID_RSNIE_;
	1938	+ /* Check CCMP pairwise_cipher presence. */
	1939	+ ppairwise_cipher = prsnie + 10;
	1940	+ _rtw_memcpy(ptdls_sta->TDLS_RSNIE, pIE->data, pIE->Length);
	1941	+ pairwise_count = (u16 )(ppairwise_cipher - 2);
	1942	+ for (k = 0; k < pairwise_count; k++) {
	1943	+ if (_rtw_memcmp(ppairwise_cipher + 4 * k, RSN_CIPHER_SUITE_CCMP, 4) == _TRUE)
	1944	+ ccmp_included = 1;
1952	1945	}
	1946	+
	1947	+ if (ccmp_included == 0)
	1948	+ txmgmt.status_code = _STATS_INVALID_RSNIE_;
1953	1949	}
1954	1950	break;
1955	1951	case _EXT_CAP_IE_:
..	..	@@ -2104,15 +2100,13 @@
2104	2100
2105	2101	switch (pIE->ElementID) {
2106	2102	case _SUPPORTEDRATES_IE_:
2107		- if (pIE->Length <= sizeof(supportRate)) {
2108		- _rtw_memcpy(supportRate, pIE->data, pIE->Length);
2109		- supportRateNum = pIE->Length;
2110		- }
	2103	+ _rtw_memcpy(supportRate, pIE->data, pIE->Length);
	2104	+ supportRateNum = pIE->Length;
2111	2105	break;
2112	2106	case _COUNTRY_IE_:
2113	2107	break;
2114	2108	case _EXT_SUPPORTEDRATES_IE_:
2115		- if ((supportRateNum + pIE->Length) <= sizeof(supportRate)) {
	2109	+ if (supportRateNum < sizeof(supportRate)) {
2116	2110	_rtw_memcpy(supportRate + supportRateNum, pIE->data, pIE->Length);
2117	2111	supportRateNum += pIE->Length;
2118	2112	}