qcacld-3.0: Add buffer length check to avoid over-read

In wma_mgmt_rx_process, mgmt_rx_params->buf_len is read
from message, if mgmt_rx_params->buf_len is larger than
data_len, it is possible to over-read from bufp with
corrupted message.

Change-Id: I7f06d81fd18960d0d6c57cdb4594680178022087
CRs-Fixed: 2126972

core/wma/src/wma_mgmt.c

@@ -3781,6 +3781,12 @@ static int wma_mgmt_rx_process(void *handle, uint8_t *data,
 		return -EINVAL;
 	}
 
+	if (mgmt_rx_params->buf_len > data_len) {
+		WMA_LOGE("%s: Invalid rx mgmt packet, data_len %u, mgmt_rx_params->buf_len %u",
+			__func__, data_len, mgmt_rx_params->buf_len);
+		return -EINVAL;
+	}
+
 	mgmt_rx_params->pdev_id = 0;
 	mgmt_rx_params->rx_params = NULL;