qcacld-3.0: Avoid buffer overread when setting probable channel
Currently in __wlan_hdd_cfg80211_set_probable_oper_channel,
nla_parse() is called to parse the command attributes without
specifying a policy. This prevents nla_parse() from doing basic
validation of the attributes, and in some circumstances could result
in a buffer overread. In addition, the tb array is not sized
correctly. To avoid these issues properly size the tb array, and
define an appropriate policy and use it in the invocation of
nla_parse().
Change-Id: I1d4bc3d1f09f0767a3cbd5ed84dc214f167c3c4d
CRs-Fixed: 2054744
1 file changed