| commit | ad80a202044103e9c3f1cbe9837cd8d2c740546e | [log] [tgz] |
|---|---|---|
| author | Lin Bai <lbai@codeaurora.org> | Tue Sep 11 22:53:28 2018 +0800 |
| committer | nshrivas <nshrivas@codeaurora.org> | Wed Sep 12 22:27:10 2018 -0700 |
| tree | 94c31c9baedde50ca9e19704f9bb15f3b556b65d | |
| parent | 8dae2e74eeb040a5710fa3c64716aaccc95c1517 [diff] |
qcacld-3.0: Check channel_count in DCC_GET_STATS command Invalid channel_count may be sent to driver with QCA_NL80211_VENDOR_SUBCMD_DCC_GET_STATS vendor command, and may also pass the sanity check with get_stats_param->request_array_len as integer overflow, in send_dcc_get_stats_cmd_tlv(). Then it will finally lead to heap overflow when initializing TLV header for each channel. Change-Id: I1d81b5fc4de80829433f2a0ab41c964c41f750c3 CRs-Fixed: 2300516