prima: Fix OOB read in lim_send_chan_switch_action_frame
In lim_send_chan_switch_action_frame, driver checks every node
in STA hash table when sending action frame. When sending action
frame, the driver will loop through the STA info hash table
(dphHashTable) to find all the STA need to receive unicast action
frame. The STA info stored in hash table (of size 41 bytes) from
the second node to the last, the first node is empty. But the current
loop is looping for 42 bytes (maxstation (of size 41 bytes) + 1)
results Invalid memory access.
Change the loop count to dphHashTable.size in order to stop OOB
read in lim_send_chan_switch_action_frame.
Change-Id: I2ee99d60c282b3f5ad660e3785ad554fb871b816
CRs-Fixed: 2356341
1 file changed