commit 591443266a84cd13e5dfdfe8d4d81bbdc6b7530f
author lifeng <lifeng@codeaurora.org> Wed Mar 20 18:05:26 2019 +0800
committer Yeshwanth Sriram Guntuka <ysriramg@codeaurora.org> Thu May 09 15:04:42 2019 +0530
tree ff7f9358ec7ef2689aafb2b199a9052edb9b1efb
parent 5180158345f8d7ddbfea9286807018175d6da9b4

wlan: Fix possible buffer overflow in sirConvertAddtsRsp2Struct

In the function sirConvertAddtsRsp2Struct, iterator j is
assigned with the value pAddTs->numTclas + addts.num_WMMTCLAS.
The j value is used as the index to the array pAddTs->tclasInfo.
Maximum limit on  pAddTs->tclasInfo entries is 2. So when the
value of j exceeds 2, then a possible buffer overflow could
occur.

Validate the value of j against SIR_MAC_TCLASIE_MAXNUM(2).

Change-Id: Icc723380ed4ccd51c729194d509e288be0e0712c
CRs-Fixed: 2449899