eap-ttls: Add an upper bound for the length of the parsed AVP

On typical systems that have overcommitting enabled, the 16 MiB maximum
that's allocated via the 24-bit length field in the AVP header shouldn't
be an issue as there are various limits that affect how much data can
actually be written to the allocated buffer (e.g. the maximum IKE message
size, the maximum TLS record size, or the maximum number of accepted
EAP-TTLS payloads), so this is primarily a defense-in-depth measure.

The length field of an EAP payload, which is the only type of AVP we
accept, is 16 bits, so that's what we now enforce as maximum.

src/libcharon/plugins/eap_ttls/eap_ttls_avp.c

@@ -20,6 +20,7 @@
 
 #define AVP_EAP_MESSAGE		79
 #define AVP_HEADER_LEN		 8
+#define AVP_LENGTH_MAX		 UINT16_MAX
 
 typedef struct private_eap_ttls_avp_t private_eap_ttls_avp_t;
 
@@ -119,7 +120,7 @@ METHOD(eap_ttls_avp_t, process, status_t,
 		chunk_free(&this->input);
 		this->inpos = 0;
 
-		if (!success || avp_len < AVP_HEADER_LEN)
+		if (!success || avp_len < AVP_HEADER_LEN || avp_len > AVP_LENGTH_MAX)
 		{
 			DBG1(DBG_IKE, "received invalid AVP header");
 			return FAILED;