qcacmn: Fix out-of-bounds write in htc_add_receive_pkt_multiple
In htc_add_receive_pkt_multiple, out-of-bounds write to a buffer.
Fix by checking the endpoint against the max endpoint.
Change-Id: Iaa82c7e8f3ae59f007380a7697959dd79dfb81ed
CRs-Fixed: 2232836
diff --git a/htc/htc_recv.c b/htc/htc_recv.c
index d6c60d3..1f18e2a 100644
--- a/htc/htc_recv.c
+++ b/htc/htc_recv.c
@@ -518,7 +518,10 @@
return A_EINVAL;
}
- AR_DEBUG_ASSERT(pFirstPacket->Endpoint < ENDPOINT_MAX);
+ if (pFirstPacket->Endpoint >= ENDPOINT_MAX) {
+ A_ASSERT(false);
+ return A_EINVAL;
+ }
AR_DEBUG_PRINTF(ATH_DEBUG_RECV,
("+- htc_add_receive_pkt_multiple : endPointId: %d, cnt:%d, length: %d\n",