RDKB-65853 Fixing coverity issue

[bharathivelp]

Reason for change: Fixing high medium priority coverity issues.
Test Procedure: Build should be successful and the regression test should also succeed.

Risks: Low
Priority: P1
Signed-off-by: Velpula_Bharathi@comcast.com

[Copilot]

Pull request overview

This PR addresses Coverity findings in the WiFi control plane by adding additional bounds checking when receiving/parsing management frames, aiming to prevent out-of-bounds access during frame handling.

Changes:

• Added a maximum-length guard for received management frames in mgmt_wifi_frame_recv() (HAL v3 path).
• Added bounds checks in GAS Initial Request parsing to prevent query data from exceeding the frame buffer.
• Adjusted the push_event_to_ctrl_queue() call site in the HAL v3 path to pass the frame struct pointer directly.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

source/core/wifi_ctrl.c:1309

• get_gas_init_frame_evt_params() reads fields from frame (e.g., adv_proto_elem->id/len) before validating that len is large enough to contain a wifi_gasInitialRequestFrame_t. If a malformed/short frame is passed in, this can trigger out-of-bounds reads and undefined behavior before the later bounds checks run. Add an early len (and null-arg) validation before computing frame_end and dereferencing the struct.

    unsigned char *frame_end = frame + len;
    wifi_advertisementProtoElement_t *adv_proto_elem;
    wifi_advertisementProtoTuple_t *adv_tuple;
    const char dpp_oui[3] = {0x50, 0x6f, 0x9a};
    wifi_gasInitialRequestFrame_t *pgas_req = (wifi_gasInitialRequestFrame_t *)frame;