wifi: Clear ring bufffers on detecting buffer corruption

While appending the newly received buffer to ring buffer list,
check the size of the first buffer in the ring buffer list.
If it is invalid(zero size or exceeding the max allowed size),
return failure & clear all the ring buffers.

Bug: 232477451
Test: vts test - 1.6/default/tests/runtests.sh
Test: Manual - Ran basic wifi tests & checked bugreports

Change-Id: Iaa41262f534914b971fe178053f1974248a46e70

1 files changed, 9 insertions, 3 deletions

diff --git a/wifi/1.6/default/ringbuffer.cpp b/wifi/1.6/default/ringbuffer.cpp
index 6d4ed843c3..981bf7bce7 100644
--- a/wifi/1.6/default/ringbuffer.cpp
+++ b/wifi/1.6/default/ringbuffer.cpp
@@ -26,20 +26,26 @@ namespace implementation {
 
 Ringbuffer::Ringbuffer(size_t maxSize) : size_(0), maxSize_(maxSize) {}
 
-void Ringbuffer::append(const std::vector<uint8_t>& input) {
+enum Ringbuffer::AppendStatus Ringbuffer::append(const std::vector<uint8_t>& input) {
     if (input.size() == 0) {
-        return;
+        return AppendStatus::FAIL_IP_BUFFER_ZERO;
     }
     if (input.size() > maxSize_) {
         LOG(INFO) << "Oversized message of " << input.size() << " bytes is dropped";
-        return;
+        return AppendStatus::FAIL_IP_BUFFER_EXCEEDED_MAXSIZE;
     }
     data_.push_back(input);
     size_ += input.size() * sizeof(input[0]);
     while (size_ > maxSize_) {
+        if (data_.front().size() <= 0 || data_.front().size() > maxSize_) {
+            LOG(ERROR) << "First buffer in the ring buffer is Invalid. Size: "
+                       << data_.front().size();
+            return AppendStatus::FAIL_RING_BUFFER_CORRUPTED;
+        }
         size_ -= data_.front().size() * sizeof(data_.front()[0]);
         data_.pop_front();
     }
+    return AppendStatus::SUCCESS;
 }
 
 const std::list<std::vector<uint8_t>>& Ringbuffer::getData() const {