wifi: libertas: cap SSID len in lbs_associate()

JIRA: https://issues.redhat.com/browse/RHEL-114889

commit c786794
Author: Dan Carpenter <dan.carpenter@linaro.org>
Date:   Fri Aug 29 15:48:35 2025 +0300

    wifi: libertas: cap SSID len in lbs_associate()
    
    If the ssid_eid[1] length is more that 32 it leads to memory corruption.
    
    Fixes: a910e4a ("cw1200: add driver for the ST-E CW1100 & CW1200 WLAN chipsets")
    Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
    Link: https://patch.msgid.link/2a40f5ec7617144aef412034c12919a4927d90ad.1756456951.git.dan.carpenter@linaro.org
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>

Signed-off-by: Jose Ignacio Tornos Martinez <jtornosm@redhat.com>

Author: jtornosm

drivers/net/wireless/marvell/libertas/cfg.c

@@ -1151,10 +1151,13 @@ static int lbs_associate(struct lbs_private *priv,
 	/* add SSID TLV */
 	rcu_read_lock();
 	ssid_eid = ieee80211_bss_get_ie(bss, WLAN_EID_SSID);
-	if (ssid_eid)
-		pos += lbs_add_ssid_tlv(pos, ssid_eid + 2, ssid_eid[1]);
-	else
+	if (ssid_eid) {
+		u32 ssid_len = min(ssid_eid[1], IEEE80211_MAX_SSID_LEN);
+
+		pos += lbs_add_ssid_tlv(pos, ssid_eid + 2, ssid_len);
+	} else {
 		lbs_deb_assoc("no SSID\n");
+	}
 	rcu_read_unlock();
 
 	/* add DS param TLV */