From 151376c3bf8f9058e22b4e0098f2d6e73d0f00f8 Mon Sep 17 00:00:00 2001
From: Varun Reddy Yeturu <varunreddy.yeturu@codeaurora.org>
Date: Wed, 30 Aug 2017 14:19:10 -0700
Subject: [PATCH] qcacld-3.0: Fix potential buffer overflow issues in RRM

Check for the maximum supported neighbor response reports while
parsing the pFrm->NeighborReport.

Change-Id: I4ee93adf79057e803bd948ed8657efcd4327efb8
CRs-Fixed: 2098766
---
 core/mac/src/pe/rrm/rrm_api.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/core/mac/src/pe/rrm/rrm_api.c b/core/mac/src/pe/rrm/rrm_api.c
index bd8f1d82e168..294fe25f6f56 100644
--- a/core/mac/src/pe/rrm/rrm_api.c
+++ b/core/mac/src/pe/rrm/rrm_api.c
@@ -354,6 +354,10 @@ rrm_process_neighbor_report_response(tpAniSirGlobal pMac,
 		pe_err("No neighbor report in the frame...Dropping it");
 		return eSIR_FAILURE;
 	}
+	pe_debug("RRM:received num neighbor reports: %d",
+			pNeighborRep->num_NeighborReport);
+	if (pNeighborRep->num_NeighborReport > MAX_SUPPORTED_NEIGHBOR_RPT)
+		pNeighborRep->num_NeighborReport = MAX_SUPPORTED_NEIGHBOR_RPT;
 	length = (sizeof(tSirNeighborReportInd)) +
 		 (sizeof(tSirNeighborBssDescription) *
 		  (pNeighborRep->num_NeighborReport - 1));