commit 093c4faaf7937f5091676f6ea2a4ae6094332e38
author CNSS_WLAN Service <cnssbldsw@qualcomm.com> Fri May 31 08:29:43 2019 -0700
committer Gerrit - the friendly Code Review server <code-review@localhost> Fri May 31 08:29:43 2019 -0700
tree c33726e8f9259a4e335ade54839509c26dd238d0
parent 802082f8f6b3296941ab1091b267e511f007c6e5
parent 4aa58d58ab0a3c5a9110235d7fb4e51984f97a41

Merge "wlan: Fix possible integer underflow in cfg80211_rx_mgmt" into wlan-driver.lnx.1.0

CORE/SME/src/rrm/sme_rrm.c

diff --git a/CORE/SME/src/rrm/sme_rrm.c b/CORE/SME/src/rrm/sme_rrm.c
index 102dc5f..9182640 100644
--- a/CORE/SME/src/rrm/sme_rrm.c
+++ b/CORE/SME/src/rrm/sme_rrm.c
@@ -856,6 +856,12 @@
 #if defined WLAN_VOWIFI_DEBUG
    smsLog( pMac, LOGE, "Received Beacon report request ind Channel = %d", pBeaconReq->channelInfo.channelNum );
 #endif
+
+   if (pBeaconReq->channelList.numChannels > SIR_ESE_MAX_MEAS_IE_REQS) {
+        smsLog( pMac, LOGP, "Beacon report request numChannels: %u exceeds "
+               "max num channels", pBeaconReq->channelList.numChannels);
+        return;
+   }
    //section 11.10.8.1 (IEEE Std 802.11k-2008) 
    //channel 0 and 255 has special meaning.
    if( (pBeaconReq->channelInfo.channelNum == 0)  ||