net: wireless: bcmdhd_oo: fix integer overflow in wl_get_assoc_ies

integer overflow case found where signed integer variable converted to
unsigned one without proper bounds checking.
Then this would result in kernel memory corruption by OOB write.

Signed-off-by: Insun Song <insun.song@broadcom.com>
Bug: 70722061
Change-Id: Idb1aa16ae1bae9c3f601e6688cd263fa95a93bdf
CVE-2017-13292
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>