qcacld-3.0: Validate sessionId before use in csr_roam_substate_change
csr_roam_set_bss_config_cfg invokes csr_roam_substate_change
with sessionId as one argument to change roam substate. In
csr_roam_substate_change, sessionId is uses as index of array
curSubState of max allowed index CSR_ROAM_SESSION_MAX(5). But
there is no any check present in csr_roam_substate_change to
validate sessionId against maximum allowed concurrent sessions.
This results Out-of-Bound access if sessionId >=
CSR_ROAM_SESSION_MAX.
Add check for sessionId against CSR_ROAM_SESSION_MAX in
csr_roam_substate_change.
Change-Id: Iae7da836001a9ccbec77cdc64df27b259f15bf4e
CRs-Fixed: 2268547
1 file changed