qcacmn: Possible Integer overflow in wifi_pos_oem_rsp_handler
API "target_if_wifi_pos_oem_rsp_ev_handler" is the handler for
the event with WMI_OEM_RESPONSE_EVENTID. Host receives
"rsp->dma_len" from fw. The integer overflow occurs if
"oem_rsp->dma_len" is big enough while calculating the total
length of the Oem Data response buffer.
Fix is to add a sanity check for rsp->dma_len to avoid integer
overflow.
Bug: 203032261
Test: Regression test
Signed-off-by: Hsiu-Chang Chen <hsiuchangchen@google.com>
Change-Id: Idfbd358f62534eae0147f03505ced5728877a269
CRs-Fixed: 3001191
2 files changed
