qcacld-3.0: Fix OOB access of sta_info for invalid sta_id

Currently, sta_id is used without validation in hdd_inspect_dhcp_packet
which may lead to OOB access for sta_info.

Call hdd_inspect_dhcp_packet only if sta_id is valid.

Change-Id: I09ebdaeeb86f8abe95fe09d23974c4bf331e29fe
CRs-Fixed: 2276615

core/hdd/src/wlan_hdd_softap_tx_rx.c

@@ -371,6 +371,11 @@ int hdd_inspect_dhcp_packet(struct hdd_adapter *adapter,
 
 	hdd_debug("sta_id=%d, dir=%d", sta_id, dir);
 
+	if (sta_id >= WLAN_MAX_STA_COUNT) {
+		hdd_err("Invalid sta id: %d", sta_id);
+		return -EINVAL;
+	}
+
 	if (((adapter->device_mode == QDF_SAP_MODE) ||
 	     (adapter->device_mode == QDF_P2P_GO_MODE)) &&
 	    ((dir == QDF_TX && QDF_NBUF_CB_PACKET_TYPE_DHCP ==
@@ -895,11 +900,11 @@ QDF_STATUS hdd_softap_rx_packet_cbk(void *context, qdf_nbuf_t rx_buf)
 				adapter->sta_info[staid].rx_bytes += skb->len;
 				adapter->sta_info[staid].last_tx_rx_ts =
 					qdf_system_ticks();
+				hdd_inspect_dhcp_packet(adapter, staid,
+							skb, QDF_RX);
 			}
 		}
 
-		hdd_inspect_dhcp_packet(adapter, staid, skb, QDF_RX);
-
 		hdd_event_eapol_log(skb, QDF_RX);
 		qdf_dp_trace_log_pkt(adapter->session_id,
 				     skb, QDF_RX, QDF_TRACE_DEFAULT_PDEV_ID);