qcacld-3.0: Add data_len check to avoid OOB access

Add data_len check in wma_stats_ext_event_handler()
to avoid OOB access.

Change-Id: I756ec66fee1cf937f144441a051e973cd561909d
CRs-Fixed: 2160395

core/wma/src/wma_utils.c

@@ -456,7 +456,8 @@ int wma_stats_ext_event_handler(void *handle, uint8_t *event_buf,
 	alloc_len += stats_ext_info->data_len;
 
 	if (stats_ext_info->data_len > (WMI_SVC_MSG_MAX_SIZE -
-	    sizeof(*stats_ext_info))) {
+	    sizeof(*stats_ext_info)) ||
+	    stats_ext_info->data_len > param_buf->num_data) {
 		WMA_LOGE("Excess data_len:%d", stats_ext_info->data_len);
 		QDF_ASSERT(0);
 		return -EINVAL;