commit 18d0c065cd8556d6638f453162b95a34944c646c
author Dundi Raviteja <dundi@codeaurora.org> Tue Nov 13 19:56:45 2018 +0530
committer Gerrit - the friendly Code Review server <code-review@localhost> Tue Dec 11 05:49:18 2018 -0800
tree b03a51514b002c8d771b816052645f4eff8866fc
parent aa083c9a0ad1257687852afb751524a317ed757c

wlan: OOB access may occur due to total numChannels exceeds max value

Out of Buffer access may occur in wmi_get_buf_extscan_start_cmd()
function if user provided inputs are different for below parameters
which are assigned in hdd_extscan_start_fill_bucket_channel_spec()
function

1. QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_NUM_CHANNEL_SPECS
2. QCA_WLAN_VENDOR_ATTR_EXTSCAN_CHANNEL_SPEC

To address this issue return failure status if numChannels is not
equal to the total number of channel entries.

Change-Id: I60d74161dc3752bd7f609af3910d7c86a99488ec
CRs-Fixed: 2349232

CORE/HDD/src/wlan_hdd_cfg80211.c

diff --git a/CORE/HDD/src/wlan_hdd_cfg80211.c b/CORE/HDD/src/wlan_hdd_cfg80211.c
index d70b5e3..62ac453 100644
--- a/CORE/HDD/src/wlan_hdd_cfg80211.c
+++ b/CORE/HDD/src/wlan_hdd_cfg80211.c
@@ -5081,6 +5081,11 @@
             j++;
        }
 
+       if (j != pReqMsg->buckets[bktIndex].numChannels) {
+            hddLog(LOG1, FL("Input parameters didn't match"));
+            return -EINVAL;
+       }
+
        bktIndex++;
     }