qcacld-3.0: Fix null pointer dereference in wma_fill_roam_synch_buffer

chan, a pointer to wmi_channel is derived from
param_buf->chan. param_buf->chan is derived from
WMI_ROAM_SYNCH_EVENTID_param_tlvs structure and
can be null. This may lead to null pointer dereference
when chan try to access the mhz field, chan->mhz.

Change-Id: I84ade344d2df3dfb5e35e7afaca3ddb768e22769
CRs-Fixed: 2385447

core/wma/src/wma_scan_roam.c

@@ -2261,7 +2261,8 @@ static int wma_fill_roam_synch_buffer(tp_wma_handle wma,
 	}
 
 	chan = (wmi_channel *) param_buf->chan;
-	roam_synch_ind_ptr->chan_freq = chan->mhz;
+	if (chan)
+		roam_synch_ind_ptr->chan_freq = chan->mhz;
 	key = (wmi_key_material *) param_buf->key;
 	if (key != NULL) {
 		qdf_mem_copy(roam_synch_ind_ptr->kck, key->kck,