qcacld-3.0: Check channel_count while handling DCC update ndl event
Invalid channel_count may be sent to driver by user with
QCA_NL80211_VENDOR_SUBCMD_DCC_UPDATE_NDL vendor command, and may also
pass the sanity check with update_ndl_param->dcc_ndl_chan_list_len as
integer overflow, in send_dcc_update_ndl_cmd_tlv. This leads to heap
overflow while updating NDL per channel.
Fix is to validate channel count sent by user in
__wlan_hdd_cfg80211_dcc_update_ndl before accessing it.
Change-Id: Icf385dd5618fcdbdbf427062fe581fa7d3909882
CRs-Fixed: 2339182
1 file changed