Merge branch 'android-msm-bonito-4.9-pi-qpr3' into android-msm-pixel-4.9

JUN 2019.3

Bug: 129973133
Change-Id: Ie2f190f356952d6b8143b1f4afcdd0e36fc2a355
Signed-off-by: Max Shi <meixuanshi@google.com>
diff --git a/core/wma/src/wma_utils.c b/core/wma/src/wma_utils.c
index e61c9d4..02eea17 100644
--- a/core/wma/src/wma_utils.c
+++ b/core/wma/src/wma_utils.c
@@ -1544,6 +1544,15 @@
 							 fixed_param->radio_id;
 	tx_power_level_values = (uint8_t *) param_tlvs->tx_time_per_power_level;
 
+	if (rs_results->total_num_tx_power_levels &&
+	    fixed_param->total_num_tx_power_levels >
+		rs_results->total_num_tx_power_levels) {
+		WMA_LOGE("%s: excess tx_power buffers:%d, total_num_tx_power_levels:%d",
+			 __func__, fixed_param->total_num_tx_power_levels,
+			 rs_results->total_num_tx_power_levels);
+		return -EINVAL;
+	}
+
 	rs_results->total_num_tx_power_levels =
 				fixed_param->total_num_tx_power_levels;
 	if (!rs_results->total_num_tx_power_levels) {