tinlin d6bdb6eb36 qcacmn: Add check for num_hw_modes ...

In extract_mac_phy_cap_service_ready_ext() the num_hw_modes
is used as loop bounds and may be attacked.

hw_mode_caps is a pointer defined by firmware. The exact
array length cannot be got since hw_mode_caps pointing array
length is variable. So use max number to  check
num_hw_modes before loop.

The max number of hw modes is 24 including 11ax.

Change-Id: I72f30ba819bca89915bb09f271e3dbe7c0f157a6
CRs-Fixed: 2369233

2019-01-17 02:22:20 -08:00

..

inc

qcacmn: Add peer param to indicate FT roam

2019-01-16 12:57:06 -08:00

src

qcacmn: Add check for num_hw_modes

2019-01-17 02:22:20 -08:00