1 files changed, 9 insertions, 2 deletions
diff --git a/service/jni/com_android_server_wifi_WifiNative.cpp b/service/jni/com_android_server_wifi_WifiNative.cpp
index 32428888c..a15377308 100644
--- a/service/jni/com_android_server_wifi_WifiNative.cpp
+++ b/service/jni/com_android_server_wifi_WifiNative.cpp
@@ -899,8 +899,15 @@ static jboolean android_net_wifi_setHotlist(
         return false;
     }
 
-    for (int i = 0; i < params.num_bssid; i++) {
-        JNIObject<jobject> objAp = helper.getObjectArrayElement(array, i);
+    if (params.num_ap >
+            static_cast<int>(sizeof(params.ap) / sizeof(params.ap[0]))) {
+        ALOGE("setHotlist array length is too long");
+        android_errorWriteLog(0x534e4554, "31856351");
+        return false;
+    }
+
+    for (int i = 0; i < params.num_ap; i++) {
+        jobject objAp = env->GetObjectArrayElement(array, i);
 
         JNIObject<jstring> macAddrString = helper.getStringField(objAp, "bssid");
         if (macAddrString == NULL) {