qcacld-3.0: Avoid potential buffer overflow in EXTERNAL_ACS
While processing vendor command EXTERNAL_ACS,
in hdd_parse_vendor_acs_chan_config() total number of channels is
computed by parsing nested attribute ACS_CHANNEL_LIST.
Initially computed number of channels is stored in int data type and
later copied to u8 data type, this shall truncate if number of channels
is greater than 255.
Memory for channel list is allocated using truncated value but later
the same list is accessed using computed value which shall result in
buffer overflow.
To address this, validate computed value against MAX_CHANNELS.
Change-Id: Idbbf3b44fd238f7cff53bedd68f2c7627ecdfa9d
CRs-Fixed: 2410869
1 file changed