first_msdu_payload is updated for every WIFIRX_HEADER_E
TLV received in the status nbuf and this could result
in incorrect offset into the nbuf for the first MSDU
if the PPDU has multiple MPDUs. Also, the size variable
used is 8 bit for the calculation of offset into the nbuf
for the frame which could result in possible overflow.
Fix is to update first_msdu_payload only for the first
WIFIRX_HEADER_E TLV entry for a PPDU and increase the
width of size variable to avoid possible integer overflow.
Change-Id: Ic12cb11328fc1414bd7a68fa941fa0ef764c8b1f
CRs-Fixed: 3788496
1051fdbb29