UBUNTU: SAUCE: rtlwifi: Fix potential overflow on P2P code

Nicolas Waisman noticed that even though noa_len is checked for
a compatible length it's still possible to overrun the buffers
of p2pinfo since there's no check on the upper bound of noa_num.
Bounds check noa_num against P2P_MAX_NOA_NUM using the minimum of the
two.

CVE-2019-17666
Reported-by: Nicolas Waisman <nico@semmle.com>
Suggested-by: Ping-Ke Shih <pkshih@realtek.com>
[tyhicks: Reuse nearly all of a commit message written by Laura Abbott]
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Andrea Righi <andrea.righi@canonical.com>
Acked-by: Stefan Bader <stefan.bader@canonical.com>
Acked-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>

drivers/net/wireless/realtek/rtlwifi/ps.c

@@ -780,7 +780,8 @@ static void rtl_p2p_noa_ie(struct ieee80211_hw *hw, void *data,
 					 noa_len);
 				return;
 			} else {
-				noa_num = (noa_len - 2) / 13;
+				noa_num = min((noa_len - 2) / 13,
+					      P2P_MAX_NOA_NUM);
 			}
 			noa_index = ie[3];
 			if (rtlpriv->psc.p2p_ps_info.p2p_ps_mode ==
@@ -874,7 +875,8 @@ static void rtl_p2p_action_ie(struct ieee80211_hw *hw, void *data,
 					 noa_len);
 				return;
 			} else {
-				noa_num = (noa_len - 2) / 13;
+				noa_num = min((noa_len - 2) / 13,
+					      P2P_MAX_NOA_NUM);
 			}
 			noa_index = ie[3];
 			if (rtlpriv->psc.p2p_ps_info.p2p_ps_mode ==