Merge cherrypicks of [2420306, 2420248, 2420158, 2420321, 2420159, 2420160, 2420266, 2420284, 2420308, 2420342, 2420177, 2420195, 2420344, 2420345, 2420179, 2420324, 2420251, 2420269, 2420271, 2420325, 2420310, 2420220, 2420348, 2420291, 2420328, 2420330, 2420383, 2420331, 2420255, 2420296, 2420278, 2420229, 2420335] into nyc-mr1-volantis-releaseandroid-7.1.1_r58android-7.1.1_r53android-7.1.1_r49nougat-mr1-volantis-releasenougat-mr1-flounder-release

Change-Id: I8a5421e9235549db7e6b63bdad655feddfdbd299

1 files changed, 8 insertions, 2 deletions

diff --git a/service/jni/com_android_server_wifi_WifiNative.cpp b/service/jni/com_android_server_wifi_WifiNative.cpp
index ad7d464ae..ffd5b559f 100644
--- a/service/jni/com_android_server_wifi_WifiNative.cpp
+++ b/service/jni/com_android_server_wifi_WifiNative.cpp
@@ -49,6 +49,7 @@ extern "C"
 jint Java_com_android_server_wifi_WifiNative_registerNanNatives(JNIEnv* env, jclass clazz);
 
 static jint DBG = false;
+constexpr int SAFE_NET_LOG_ID = 0x534e4554;
 
 //Please put all HAL function call here and call from the function table instead of directly call
 wifi_hal_fn hal_fn;
@@ -790,7 +791,7 @@ static jboolean android_net_wifi_setHotlist(
     if (params.num_bssid >
             static_cast<int>(sizeof(params.ap) / sizeof(params.ap[0]))) {
         ALOGE("setHotlist array length is too long");
-        android_errorWriteLog(0x534e4554, "31856351");
+        android_errorWriteLog(SAFE_NET_LOG_ID, "31856351");
         return false;
     }
 
@@ -909,7 +910,12 @@ static jboolean android_net_wifi_trackSignificantWifiChange(
         ALOGE("BssidInfo array length was 0");
         return false;
     }
-
+    if (params.num_bssid >
+        static_cast<int>(sizeof(params.ap) / sizeof(params.ap[0]))) {
+        ALOGE("trackSignificantWifiChange array length is too long");
+        android_errorWriteLog(SAFE_NET_LOG_ID, "37775935");
+        return false;
+    }
     ALOGD("Initialized common fields %d, %d, %d, %d", params.rssi_sample_size,
             params.lost_ap_sample_size, params.min_breaching, params.num_bssid);