tree 148e1f8f26c4e78ffb4c92ed358feafbb14894e5
parent 54d31a3cdc694322e1d71eb9d940444c0744d19f
author Ashish Kumar Dhanotiya <adhanoti@codeaurora.org> 1502720852 +0530
committer Ashish Kumar Dhanotiya <adhanoti@codeaurora.org> 1502883204 +0530

wlan: Avoid overflow of EXTSCAN bucket list

Currently when processing an EXTSCAN vendor command the "num buckets"
attribute is limit checked and if it exceeds a MAX value then a
warning message is issued. But beyond that the "num buckets" attribute
is not used. Instead when the buckets are actually parsed the number
of buckets is calculated dynamically based upon the number of
attributes present in the request. Unfortunately when the bucket
attributes are parsed there is no check to make sure the number of
buckets processed does not exceed the MAX value, and as a result a
buffer overflow can occur. Address this issue by aborting the bucket
parsing once the expected number of records have been parsed.

Change-Id: Ic260dd65dc99118afbb8042d102acb5b26d1e123
CRs-Fixed: 1087797
Bug: 32451104