Nicolas Waisman noticed that even though noa_len is checked for
a compatible length it's still possible to overrun the buffers
of p2pinfo since there's no check on the upper bound of noa_num.
Bounds check noa_num against P2P_MAX_NOA_NUM using the minimum of the
two.

CVE-2019-17666
Reported-by: Nicolas Waisman <nico@semmle.com>
Suggested-by: Ping-Ke Shih <pkshih@realtek.com>
[tyhicks: Reuse nearly all of a commit message written by Laura Abbott]
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Andrea Righi <andrea.righi@canonical.com>
Acked-by: Stefan Bader <stefan.bader@canonical.com>
Acked-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>