qcacld-2.0: Add bound check for fixed_param->total_num_tx_power_levels

propagation from qcacld-3.0 to qcacld-2.0

Add bound check for new fixed_param->total_num_tx_power_levels
with its old value of rs_results->total_num_tx_power_levels in
wma_unified_radio_tx_power_level_stats_event_handler.

rs_results->tx_time_per_power_level is allocated only once
if it has not been already allocated.This allocation is saved
into the global wma_handle structure.

If multiple invocations of this handler occur then a buffer
overflow  can occur in the following scenario:
1. First message is used to allocate rs_results->tx_time_per_power_level
with a small, but valid size.
2. Second message skips allocation of rs_results->tx_time_per_power_level
since it was done with the first message. This message specifies a larger
valid value and causes the vos_mem_copy() to overflow.

Change-Id: Ia46d5f965584da380509ec2e39a405219e8d216f
CRs-Fixed: 2457412

0 files changed, 0 insertions, 0 deletions