qcacmn: Fix memory copy overflow in dp_process_htt_stat_msg

In dp_process_htt_stat_msg function, the stats message must be
interpreted one by one. It can't move to the next message unless
the current one is handled completedly. Or else it will cause a
memory copy overflow.

CRs-Fixed: 2156792
Change-Id: I8a3784cd17f2a68b16c4f47c6b1a24e12d23aaa5

dp/wifi3.0/dp_htt.c

@@ -1404,7 +1404,8 @@ static inline void dp_process_htt_stat_msg(struct htt_stats_context *htt_stats,
 				goto error;
 			}
 
-			tlv_remain_len += HTT_TLV_HDR_LEN;
+			if (!tlv_buf_head)
+				tlv_remain_len += HTT_TLV_HDR_LEN;
 
 			if ((tlv_remain_len <= msg_remain_len)) {
 				/* Case 3 */
@@ -1454,7 +1455,6 @@ static inline void dp_process_htt_stat_msg(struct htt_stats_context *htt_stats,
 						msg_remain_len);
 				tlv_remain_len -= msg_remain_len;
 				tlv_buf_tail += msg_remain_len;
-				msg_remain_len = 0;
 			}
 		}