qcacmn: Possible Out of bound read in policy_mgr_get_channel_list
To prepare the channel list suggestion for a new connection,
policy_mgr_get_channel_list invokes policy_mgr_get_valid_chans to
get the number of valid channels. Driver uses returned num channel
and iterates channel list to divide the list into 2.4 & 5 GHz
lists. In case if, num of valid channel returned by
policy_mgr_get_valid_chans is greater than the maximum number of
channel supported in the channel list, QDF_MAX_NUM_CHAN(128),
possible OOB read occurs.
Validate the value of chan_index of channel list in
policy_mgr_get_channel_list against the maximum number of
channels supported in the channel list.
Change-Id: I6beb9231aaef491731557434d1ae210ac0bdb036
CRs-Fixed: 2346125
1 file changed