DroidSec: Buffer Overflow in wcnss_wowpattern_write

In the function wcnss_wowpattern_write, buf and count are supplied
by the user.A local variable cmd is allocated on the stack.There is
a check to ensure that there cannot be an overflow.Later, count byte
s of data are copied from buf to the local variable cmd and cmd is
explicitly null terminated.However, if count is
MAX_USER_COMMAND_SIZE_WOWL_PATTERN, the check is bypassed and the
explicit null termination is a one byte stack-based buffer overflow.

Change-Id: Id1719b52f7a6f099f6eadc914fd609aa959f7b61
CRs-fixed: 548113
wlan: Updates for Regulatory Domain

Changin few regulatory domains as part of the requirement.

Change-Id: Id10815e36a6d19e9969ad0b63f83e163033215cd
CRs-fixed: 549879
Fix for VOSS assert observed during WFD session

Vos Assert observed in the driver due to the JOIN_FAIL_TIMER timeout
for session which does not exist.deactivate the JOIN_FAIL_TIMER
in the cleanup process of auth/assoc failure.

Change-Id: I7767a1053e709a1f850721b71d2d681fa15f3e8d
CRs-fixed: 539569
wlan: Replace snprintf with scnprintf

The function snprintf() do not write more than size bytes (including
the terminating null byte ('\0')). If the output was truncated due
to this limit then the return value is the number of characters
(excluding the terminating null byte) which would have been written
to the final string if enough space had been available. Thus, a
return value of size or more means that the output was truncated.

Change-Id: Iccf9648961e2ac9eeffa0f824a80fd3798be3870
CRs-Fixed: 548711
Wlan: Revision 3.2.3.184

Revision 3.2.3.184