tree c1f0450c91738a926e98d48649a85bb9f4f86a00
parent f950e558c5c093fde098ef75b7aa738004818336
author Abhishek Ambure <aambure@codeaurora.org> 1576133752 +0530
committer Abhishek Ambure <aambure@codeaurora.org> 1576144817 +0530

wlan: Add max index check for dscp_to_up_map array

qcacld-3.0 to prima propagation.

In SME layer, boundary check for dscp_to_up_map array is not present.

The dscpmapping is an array of 0x40 elements. Values in dscp_exceptions
are used to index dscpmapping. The indices are not validated to be less
than 0x40. The dscp_exceptions array is received from association
response frame. A malicious AP can send values up to 0xff, causing OOB
write of dscpmapping array.

Hence, max index check is added to avoid OOB write of dscpmapping array.

Change-Id: I73526849677e867673fc0bd0024ed2b003e4f89e
CRs-Fixed: 2585141