wlan: fix possible OOB read in SIOCSIWRATE WEXT ioctl handler
The values used to dictate the end of the for loop is great than the
size of array supp_rates, this will cause an OOB read when loop
through supp_rates. So need modify the size of array supp_rates.
There's also a functional issue in that the second call to
sme_cfg_get_str() overwrites the lower values of the first call,
thus not ever allowing the lower channel rates of A to ever be
valid. So need update the read buffer address for the second
sme_cfg_get_str().
CRs-Fixed: 2247498
Change-Id: I27091a9f48d1eb4d6806ebcfd2310fe848af408f
1 file changed