qcacld-3.0: Add key index check for Multi password SAP

In the api wlan_hdd_add_vlan(), key index value check
is not present which can cause buffer overflow.

Add keyindex check in the api wlan_hdd_vlan_sap()
in order to prevent the buffer overflow.

Change-Id: I87c606eed6b4e169d6e059cd5d06342c2bc0adaf
CRs-Fixed: 3560531

core/hdd/src/wlan_hdd_cfg80211.c

@@ -22506,6 +22506,7 @@ wlan_hdd_add_vlan(struct wlan_objmgr_vdev *vdev, struct sap_context *sap_ctx,
 	ol_txrx_soc_handle soc_txrx_handle;
 	uint16_t *vlan_map = sap_ctx->vlan_map;
 	uint8_t found = 0;
+	bool keyindex_valid;
 	int i = 0;
 
 	psoc = wlan_vdev_get_psoc(vdev);
@@ -22514,7 +22515,7 @@ wlan_hdd_add_vlan(struct wlan_objmgr_vdev *vdev, struct sap_context *sap_ctx,
 		return -EINVAL;
 	}
 
-	for (i = 0; i < (MAX_VLAN - 1); i += 2) {
+	for (i = 0; i < (MAX_VLAN * 2); i += 2) {
 		if (!vlan_map[i] || !vlan_map[i + 1]) {
 			found = 1;
 			break;
@@ -22527,7 +22528,9 @@ wlan_hdd_add_vlan(struct wlan_objmgr_vdev *vdev, struct sap_context *sap_ctx,
 		}
 	}
 
-	if (found) {
+	keyindex_valid = (i + key_index - 1) < (2 * MAX_VLAN) ? true : false;
+
+	if (found && keyindex_valid) {
 		soc_txrx_handle = wlan_psoc_get_dp_handle(psoc);
 		vlan_map[i + key_index - 1] = params->vlan_id;
 		wlan_hdd_set_vlan_groupkey(soc_txrx_handle,

core/sap/src/sap_internal.h

@@ -257,7 +257,7 @@ struct sap_context {
 	bool clean_channel_array[NUM_CHANNELS];
 #endif
 #ifdef QCA_MULTIPASS_SUPPORT
-	uint16_t vlan_map[MAX_VLAN];
+	uint16_t vlan_map[2 * MAX_VLAN];
 #endif
 };