Integrate memory corruption fixes from windows core stack
fuzz tests were conducted and memory corruption fixes were done in windows
core stack.integrate the fixes into android host core stack.
these fixes include the following
1.Handle invalid frames passed on to host
- Drop & Free frame buffer identified by error in length
2. Scan list crash to protect from handling missing and corrupted IEs
- enforce mandatory IE (SSID) in Probe Response
3.Protect Access to IE field in ProbeResponse that is not present
4.Check for Input Buffer length beforebeacon packet processing
5.Add check to store only first 100 channels
6.pass corect length in scan rsp frame
CRs-fixed: 441303,443082
Change-Id: I7dd647e4f3359d5c78225dd92811f116df9caa90
diff --git a/CORE/MAC/src/pe/lim/limProcessSmeReqMessages.c b/CORE/MAC/src/pe/lim/limProcessSmeReqMessages.c
index c8abd17..866c204 100644
--- a/CORE/MAC/src/pe/lim/limProcessSmeReqMessages.c
+++ b/CORE/MAC/src/pe/lim/limProcessSmeReqMessages.c
@@ -1183,7 +1183,7 @@
//if scan in power save is disabled, and system is in power save mode, then ignore scan request.
if( (pMac->lim.fScanDisabled) || (!pMac->lim.gScanInPowersave && !limIsSystemInActiveState(pMac)) )
{
- limSendSmeScanRsp(pMac, 8, eSIR_SME_INVALID_PARAMETERS, pScanReq->sessionId, pScanReq->transactionId);
+ limSendSmeScanRsp(pMac, offsetof(tSirSmeScanRsp,bssDescription[0]), eSIR_SME_INVALID_PARAMETERS, pScanReq->sessionId, pScanReq->transactionId);
return;
}
@@ -1609,7 +1609,7 @@
goto end;
}
VOS_TRACE(VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_INFO_MED,
- "***__limProcessSmeJoinReq: txBFCsnValue=%d****\n",pSmeJoinReq->txBFCsnValue);
+ "***__limProcessSmeJoinReq: txBFCsnValue=%d****", pSmeJoinReq->txBFCsnValue);
if (cfgSetInt(pMac, WNI_CFG_VHT_CSN_BEAMFORMEE_ANT_SUPPORTED, pSmeJoinReq->txBFCsnValue)
!= eSIR_SUCCESS)