drivers: wifi: siwx91x: Fix buffer overflow in client disconnect

Copy only WIFI_MAC_ADDR_LEN bytes to sta_info.mac instead of dynamic
length

Signed-off-by: Muzaffar Ahmed <[email protected]>

Author: muahmed-silabs

drivers/wifi/siwx91x/siwx91x_wifi.c

@@ -885,14 +885,15 @@ static sl_status_t siwx91x_on_ap_sta_connect(sl_wifi_event_t event, void *data,
 					     uint32_t data_length, void *arg)
 {
 	ARG_UNUSED(event);
+	ARG_UNUSED(data_length);
 	struct siwx91x_dev *sidev = arg;
 	struct wifi_ap_sta_info sta_info = { };
 
 	__ASSERT(data, "data cannot be NULL");
 	__ASSERT(arg, "arg cannot be NULL");
 
-	memcpy(sta_info.mac, data, data_length);
-	sta_info.mac_length = data_length;
+	memcpy(sta_info.mac, data, WIFI_MAC_ADDR_LEN);
+	sta_info.mac_length = WIFI_MAC_ADDR_LEN;
 	sta_info.link_mode = WIFI_LINK_MODE_UNKNOWN;
 
 	wifi_mgmt_raise_ap_sta_connected_event(sidev->iface, &sta_info);
@@ -904,14 +905,15 @@ static sl_status_t siwx91x_on_ap_sta_disconnect(sl_wifi_event_t event, void *dat
 						uint32_t data_length, void *arg)
 {
 	ARG_UNUSED(event);
+	ARG_UNUSED(data_length);
 	struct siwx91x_dev *sidev = arg;
 	struct wifi_ap_sta_info sta_info = { };
 
 	__ASSERT(data, "data cannot be NULL");
 	__ASSERT(arg, "arg cannot be NULL");
 
-	memcpy(sta_info.mac, data, data_length);
-	sta_info.mac_length = data_length;
+	memcpy(sta_info.mac, data, WIFI_MAC_ADDR_LEN);
+	sta_info.mac_length = WIFI_MAC_ADDR_LEN;
 	wifi_mgmt_raise_ap_sta_disconnected_event(sidev->iface, &sta_info);
 
 	return SL_STATUS_OK;