EAP-pwd peer: Fix last fragment length validation
EAP-pwd peer: Fix last fragment length validation

All but the last fragment had their length checked against the remaining
room in the reassembly buffer. This allowed a suitably constructed last
fragment frame to try to add extra data that would go beyond the buffer.
The length validation code in wpabuf_put_data() prevents an actual
buffer write overflow from occurring, but this results in process
termination. (CVE-2015-5315)

Change-Id: I22f5491fc76db5fb56d2a71f17c2fc3e18abb520
Signed-off-by: Jouni Malinen <5c2dd944dde9e08881bef0894fe7b22a5c9c4b06@w1.fi>

JunhwanPark/TizenRT,JunhwanPark/TizenRT,JunhwanPark/TizenRT,JunhwanPark/TizenRT,JunhwanPark/TizenRT,JunhwanPark/TizenRT