fc5bbedd4a
In function wma_extscan_hotlist_match_event_handler, numap and src_hotlist are received from the FW. src_hotlist is pointer to the hostist data and is looped for numap times and copied to the local buffer dest_hotlist. If the value of numap is not equal to the number of src_hotlist data present in the buffer, buffer overread would occur during memcpy. Add check to validate the len of the buffer received from the FW is not less than the size of fixparam struct + (numap * src_hostlist structure) Change-Id: I2dc596f91bc49ccf0327062aa6732cd072d52085 CRs-Fixed: 2139436
This is CNSS WLAN Host Driver for products starting from iHelium