qcacld-3.0: Fix IE length in function sme_get_beacon_frm

Fix IE length in function sme_get_beacon_frm.

Change-Id: Iaec7f14e0e2c9078037fbbb586d9d0ac64b4e0de
CRs-Fixed: 2055891

core/sme/src/common/sme_api.c

@@ -15975,12 +15975,19 @@ QDF_STATUS sme_get_beacon_frm(tHalHandle hal, tCsrRoamProfile *profile,
 		goto free_scan_flter;
 	}
 
-	/*
+	/**
-	 * bss_descp->length = sizeof(tSirBssDescription) - sizeof(length_field)
+	 * Length of BSS descriptor is without length of
-	 * - sizeof(ieFields) + ie_len;
+	 * length itself and length of pointer that holds ieFields.
+	 *
+	 * tSirBssDescription
+	 * +--------+---------------------------------+---------------+
+	 * | length | other fields                    | pointer to IEs|
+	 * +--------+---------------------------------+---------------+
+	 *                                            ^
+	 *                                            ieFields
 	 */
-	ie_len = bss_descp->length - sizeof(tSirBssDescription)
+	ie_len = bss_descp->length + sizeof(bss_descp->length)
-		+ sizeof(bss_descp->length) + sizeof(bss_descp->ieFields);
+		- (uint16_t)(offsetof(tSirBssDescription, ieFields[0]));
 	sme_debug("found bss_descriptor ie_len: %d channel %d",
 					ie_len, bss_descp->channelId);