qcacld-3.0: Add length check in wma_process_rmf_frame

The driver verifies the replay_attack in protected
management frames in the API wma_is_ccmp_pn_replay_attack
The API expects a CCMP header pointer, but it may happen that
the size of the total frame is less than the size of ieee frame
+ the CCMP header length. In that case the CCMP pointer will
point to some memory location  not allocated to the frame, which
will result to out of bound access.

Fix is to add a length check to memory allocated to wbuf in
wma_process_rmf_frame

Change-Id: I351fa671cb8728843c8843c27dd91bcb201abb42
CRs-Fixed: 2230976

core/wma/src/wma_mgmt.c

@@ -3431,6 +3431,19 @@ int wma_process_rmf_frame(tp_wma_handle wma_handle,
 			cds_pkt_return_packet(rx_pkt);
 			return -EINVAL;
 		}
+	if (iface->ucast_key_cipher == WMI_CIPHER_AES_GCM) {
+		hdr_len = WLAN_IEEE80211_GCMP_HEADERLEN;
+		mic_len = WLAN_IEEE80211_GCMP_MICLEN;
+	} else {
+		hdr_len = IEEE80211_CCMP_HEADERLEN;
+		mic_len = IEEE80211_CCMP_MICLEN;
+	}
+	if (qdf_nbuf_len(wbuf) < (sizeof(*wh) + hdr_len + mic_len)) {
+		WMA_LOGE("Buffer length less than expected %d",
+					(int)qdf_nbuf_len(wbuf));
+		cds_pkt_return_packet(rx_pkt);
+		return -EINVAL;
+	}
 
 		orig_hdr = (uint8_t *) qdf_nbuf_data(wbuf);
 		/* Pointer to head of CCMP header */
@@ -3442,13 +3455,6 @@ int wma_process_rmf_frame(tp_wma_handle wma_handle,
 			return -EINVAL;
 		}
 
-		if (iface->ucast_key_cipher == WMI_CIPHER_AES_GCM) {
-			hdr_len = WLAN_IEEE80211_GCMP_HEADERLEN;
-			mic_len = WLAN_IEEE80211_GCMP_MICLEN;
-		} else {
-			hdr_len = IEEE80211_CCMP_HEADERLEN;
-			mic_len = IEEE80211_CCMP_MICLEN;
-		}
 		/* Strip privacy headers (and trailer)
 		 * for a received frame
 		 */