Qualcomm ≫ Sa8540p Firmware

Memory corruption when invalid length is provided from HLOS for FRS/UDS request/response buffers.

Transient DOS while parsing the multi-link element Control field when common information length check is missing before updating the location.

Transient DOS while parsing MBSSID during new IE generation in beacon/probe frame when IE length check is either missing or improper.

Memory corruption while calculating total metadata size when a very high reserved size is requested by gralloc clients.

Memory corruption when BTFM client sends new messages over Slimbus to ADSP.

Cryptographic issue while parsing RSA keys in COBR format.

Memory corruption while releasing shared resources in MinkSocket listener thread.

memory corruption when an invalid firehose patch command is invoked.

Memory corruption as fence object may still be accessed in timeline destruct after isync fence is released.

Memory corruption while processing IOCTL call to set metainfo.