qcacld-3.0: Validate APF memory offset in APF offload vendor command

Currently, APF memory offset is sent to the firmware without validation.
This may cause out of bound memory access in the firmware.

To avoid this, validate apf memory offset with MAX_APF_MEMORY_LEN in
the driver.

Change-Id: I5657f570a820b73b9e07a6fb1ce54807156def24
CRs-Fixed: 2711515

core/hdd/src/wlan_hdd_apf.c

@@ -508,6 +508,11 @@ static int hdd_apf_read_memory(struct hdd_adapter *adapter, struct nlattr **tb)
 		return -EINVAL;
 	}
 	read_mem_params.addr_offset = nla_get_u32(tb[APF_CURRENT_OFFSET]);
+	if (read_mem_params.addr_offset > MAX_APF_MEMORY_LEN) {
+		hdd_err("attr apf memory offset should be less than %d",
+			MAX_APF_MEMORY_LEN);
+		return -EINVAL;
+	}
 
 	/* Read length */
 	if (!tb[APF_PACKET_SIZE]) {