47c7d6990de885355f490e855e1bf20612f3cc18

In function wifi_pos_process_app_reg_req(), it uses function wifi_pos_get_vdev_count to get vdev_count; Then wifi_pos_process_app_reg_req-> wifi_pos_get_vdev_list-> wlan_objmgr_iterate_obj_list, it uses wlan_psoc_get_max_vdev_count to get max_vdev_cnt, if vdev is not NULL, it invokes function wifi_pos_vdev_iterator to fill the vdev_info. For the failure scenario: In wifi_pos_process_app_reg_req, it gets 2 for vdev_count from function wifi_pos_get_vdev_count; Then the process is interrupted and vdev 2 is created in another process; Now since there are vdev 0, 1, 2, wifi_pos_vdev_iterator is called 3 times and memory corruption happens since it writes two more bytes with op mode and vdev id in vdev_info. Change-Id: I5222836a1448bfaa7df31c919419d448eaa20895 CRs-Fixed: 3320183
This is CNSS WLAN Host Driver for products starting from iHelium
Description
Langue
C
98.7%
C++
0.9%
Makefile
0.3%
Starlark
0.1%