qcacld-3.0: Avoid buffer overflow of csr_wpa_oui array

In csr_validate_wep(), return value of csr_get_oui_index_from_cipher() is
used to fetch 'csr_wpa_oui' value. csr_get_oui_index_from_cipher() returns
0-14 but no.of rows of 'csr_wpa_oui' is 7.

Add changes to validate index value before accessing 'csr_wpa_oui' array.

Change-Id: I0cf16f4e8fb2c07a489991f20bc345e97b2450e0
CRs-Fixed: 2077599

core/sme/src/csr/csr_util.c

@@ -2954,9 +2954,12 @@ static bool csr_match_wpaoui_index(tpAniSirGlobal pMac,
 				   uint8_t cAllCyphers, uint8_t ouiIndex,
 				   uint8_t Oui[])
 {
-	return csr_is_oui_match
+	if (ouiIndex < QDF_ARRAY_SIZE(csr_wpa_oui))
-		(pMac, AllCyphers, cAllCyphers, csr_wpa_oui[ouiIndex], Oui);
+		return csr_is_oui_match
-
+			(pMac, AllCyphers, cAllCyphers,
+			 csr_wpa_oui[ouiIndex], Oui);
+	else
+		return false;
 }
 
 #ifdef FEATURE_WLAN_WAPI
@@ -4355,6 +4358,7 @@ static bool csr_validate_wep(tpAniSirGlobal mac_ctx,
 	bool match = false;
 	eCsrAuthType negotiated_auth = eCSR_AUTH_TYPE_OPEN_SYSTEM;
 	eCsrEncryptionType negotiated_mccipher = eCSR_ENCRYPT_TYPE_UNKNOWN;
+	uint8_t oui_index;
 
 	/* If privacy bit is not set, consider no match */
 	if (!csr_is_privacy(bss_descr))
@@ -4420,10 +4424,11 @@ static bool csr_validate_wep(tpAniSirGlobal mac_ctx,
 
 	/* else we can use the encryption type directly */
 	if (ie_ptr->WPA.present) {
-		match = (!qdf_mem_cmp(ie_ptr->WPA.multicast_cipher,
+		oui_index = csr_get_oui_index_from_cipher(uc_encry_type);
-				csr_wpa_oui[csr_get_oui_index_from_cipher(
+		if (oui_index < QDF_ARRAY_SIZE(csr_wpa_oui))
-					uc_encry_type)],
+			match = (!qdf_mem_cmp(ie_ptr->WPA.multicast_cipher,
-				CSR_WPA_OUI_SIZE));
+					csr_wpa_oui[oui_index],
+					CSR_WPA_OUI_SIZE));
 		if (match)
 			goto end;
 	}