qcacld-3.0: Fix out of bound access in convert_qos_mapset_frame
In function convert_qos_mapset_frame, restrict dscp_exceptions array
access index to size of array
Change-Id: I31ed8edaee1a9b3715f66686a8a45d5f2ffd4532
CRs-Fixed: 1042968
diff --git a/core/mac/src/sys/legacy/src/utils/src/utils_parser.c b/core/mac/src/sys/legacy/src/utils/src/utils_parser.c
index e300de3..32543fa 100644
--- a/core/mac/src/sys/legacy/src/utils/src/utils_parser.c
+++ b/core/mac/src/sys/legacy/src/utils/src/utils_parser.c
@@ -722,7 +722,7 @@
Qos->dscp_exceptions[i][1] = dot11fIE->dscp_exceptions[j];
j++;
}
- for (i = 0; i < 8; i++) {
+ for (i = 0; i < 8 && j < dot11_dscp_sz; i++) {
Qos->dscp_range[i][0] = dot11fIE->dscp_exceptions[j];
j++;
Qos->dscp_range[i][1] = dot11fIE->dscp_exceptions[j];