qcacld-3.0: Fix to pass appropriate buffer length to unpack RSN IE

In lim_set_rs_nie_wp_aiefrom_sme_start_bss_req_message, length passed
to unpack RSN IE is total length of WPA and RSN IE. So if only WPA IE
is present in assoc request, the RSN IE parser will try to validate the
buffer beyond the RSN IE and might fail as the buffer belongs to WPA IE.

Pass appropriate length to unpack RSN IE.

Change-Id: Ie679e67061e7ac622e8e76b285a32135a60ca6e8
CRs-Fixed: 2189926

core/mac/src/pe/lim/lim_sme_req_utils.c

@@ -285,14 +285,16 @@ lim_set_rs_nie_wp_aiefrom_sme_start_bss_req_message(tpAniSirGlobal mac_ctx,
 		   (rsn_ie->rsnIEdata[0] == SIR_MAC_RSN_EID)) {
 		pe_debug("Only RSN IE is present");
 		sir_unpack_rsn_ie(mac_ctx, &rsn_ie->rsnIEdata[2],
-				     (uint8_t) rsn_ie->length,
+				     rsn_ie->rsnIEdata[1],
 				     &session->gStartBssRSNIe, false);
+		return true;
 	} else if ((rsn_ie->length == rsn_ie->rsnIEdata[1] + 2)
 		   && (rsn_ie->rsnIEdata[0] == SIR_MAC_WPA_EID)) {
 		pe_debug("Only WPA IE is present");
 		dot11f_unpack_ie_wpa(mac_ctx, &rsn_ie->rsnIEdata[6],
 				     (uint8_t) rsn_ie->length - 4,
 				     &session->gStartBssWPAIe, false);
+		return true;
 	}
 	/* Check validity of WPA IE */
 	if (wpa_idx + 6 >= SIR_MAC_MAX_IE_LENGTH)
@@ -311,7 +313,7 @@ lim_set_rs_nie_wp_aiefrom_sme_start_bss_req_message(tpAniSirGlobal mac_ctx,
 	} else {
 		/* Both RSN and WPA IEs are present */
 		sir_unpack_rsn_ie(mac_ctx, &rsn_ie->rsnIEdata[2],
-				     (uint8_t) rsn_ie->length,
+				     rsn_ie->rsnIEdata[1],
 				     &session->gStartBssRSNIe, false);
 		dot11f_unpack_ie_wpa(mac_ctx, &rsn_ie->rsnIEdata[wpa_idx + 6],
 				     rsn_ie->rsnIEdata[wpa_idx + 1] - 4,