qcacld-3.0: Fix potential OOB read when check rx mgmt frames

In function is_p2p_action_frame, it just checks frame length with 28,
but read 30 bytes actually, and cause OOB read potentially. So, check
length with 30.

Change-Id: Id2bd4276838f1eae49e8a24e8ab3361a69321a69
CRs-Fixed: 2263727
Bug: 125677805
Signed-off-by: Srinivas Girigowda <quic_sgirigow@quicinc.com>
Signed-off-by: Adam W. Willis <return.of.octobot@gmail.com>

drivers/staging/qcacld-3.0/core/hdd/src/wlan_hdd_p2p.c

@@ -3285,8 +3285,8 @@ static inline bool is_public_action_frame(uint8_t *pb_frames,
 static inline bool is_p2p_action_frame(uint8_t *pb_frames,
 				       uint32_t frame_len)
 {
-	if (frame_len <= WLAN_HDD_PUBLIC_ACTION_FRAME_OFFSET +
-	    SIR_MAC_P2P_OUI_SIZE) {
+	if (frame_len <= (WLAN_HDD_PUBLIC_ACTION_FRAME_OFFSET +
+	    SIR_MAC_P2P_OUI_SIZE + 2)) {
 		hdd_debug("Not a p2p action frame len: %d", frame_len);
 		return false;
 	}