qcacld-3.0: Fix array OOB for duplicate rate

Some IoT AP may have duplicate rates in supported rates and
extended rates in beacon, need filter them when populate peer 11a/11b
rates during connect/roaming, or array out of bound issue will happen.

Change-Id: I685e8c07ee147296bfa22742dad4210e7fa02c4a
CRs-Fixed: 3048142

core/mac/src/pe/lim/lim_assoc_utils.c

@@ -1672,7 +1672,6 @@ QDF_STATUS lim_populate_peer_rate_set(struct mac_context *mac,
 	for (i = 0; i < tempRateSet.numRates; i++) {
 		min = 0;
 		val = 0xff;
-		isArate = 0;
 		for (j = 0; (j < tempRateSet.numRates) &&
 		     (j < SIR_MAC_MAX_NUMBER_OF_RATES); j++) {
 			if ((uint32_t)(tempRateSet.rate[j] & 0x7f) <
@@ -1681,8 +1680,22 @@ QDF_STATUS lim_populate_peer_rate_set(struct mac_context *mac,
 				min = j;
 			}
 		}
-		if (sirIsArate(tempRateSet.rate[min] & 0x7f))
+		if (sirIsArate(tempRateSet.rate[min] & 0x7f)) {
 			isArate = 1;
+		} else if (sirIsBrate(tempRateSet.rate[min] & 0x7f)) {
+			isArate = 0;
+		} else {
+			pe_debug("%d is neither 11a nor 11b rate",
+				 tempRateSet.rate[min]);
+			tempRateSet.rate[min] = 0xff;
+			continue;
+		}
+		if (tempRateSet.rate[min] == pRates->llaRates[aRateIndex] ||
+		    tempRateSet.rate[min] == pRates->llbRates[bRateIndex]) {
+			pe_debug("Duplicate rate: %d", tempRateSet.rate[min]);
+			tempRateSet.rate[min] = 0xff;
+			continue;
+		}
 		/*
 		 * HAL needs to know whether the rate is basic rate or not,
 		 * as it needs to update the response rate table accordingly.
@@ -1690,23 +1703,16 @@ QDF_STATUS lim_populate_peer_rate_set(struct mac_context *mac,
 		 * can be used for sending control frames. HAL updates the
 		 * response rate table whenever basic rate set is changed.
 		 */
-		if (basicOnly) {
-			if (tempRateSet.rate[min] & 0x80) {
-				if (isArate)
-					pRates->llaRates[aRateIndex++] =
-						tempRateSet.rate[min];
-				else
-					pRates->llbRates[bRateIndex++] =
-						tempRateSet.rate[min];
-			}
-		} else {
-			if (isArate)
-				pRates->llaRates[aRateIndex++] =
+		if (basicOnly && !(tempRateSet.rate[min] & 0x80)) {
+			tempRateSet.rate[min] = 0xff;
+			continue;
+		}
+		if (isArate && aRateIndex < SIR_NUM_11A_RATES)
+			pRates->llaRates[aRateIndex++] =
 					tempRateSet.rate[min];
-			else
-				pRates->llbRates[bRateIndex++] =
+		else if (bRateIndex < SIR_NUM_11B_RATES)
+			pRates->llbRates[bRateIndex++] =
 					tempRateSet.rate[min];
-		}
 		tempRateSet.rate[min] = 0xff;
 	}