qcacld-3.0: Add check for bss_list size in wma_group_num_bss_to_scan_id

In wma_group_num_bss_to_scan_id(), bssid_list may get accessed
outside of the available buffer size.

Fix the possible out of boundary access by adding a check.

Change-Id: I5e278bd96b8f57c96f53d7c3cd8f4f3e5a67fc6c
CRs-Fixed: 2385431

core/wma/src/wma_scan_roam.c

@@ -4131,6 +4131,17 @@ static int wma_group_num_bss_to_scan_id(const u_int8_t *cmd_param_info,
 	t_cached_result = cached_result;
 	t_scan_id_grp = &t_cached_result->result[0];
 
+	if ((t_cached_result->num_scan_ids *
+	     QDF_MIN(t_scan_id_grp->num_results,
+		     param_buf->num_bssid_list)) > param_buf->num_bssid_list) {
+		WMA_LOGE("%s:num_scan_ids %d, num_results %d num_bssid_list %d",
+			 __func__,
+			 t_cached_result->num_scan_ids,
+			 t_scan_id_grp->num_results,
+			 param_buf->num_bssid_list);
+		return -EINVAL;
+	}
+
 	WMA_LOGD("%s: num_scan_ids:%d", __func__,
 			t_cached_result->num_scan_ids);
 	for (i = 0; i < t_cached_result->num_scan_ids; i++) {