wpa_supplicant: Fix CVE-2015-1863

[kwm]

Summary

Fix CVE in wpa_supplicant inspired by
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=199678

This should probably be MFC'd to the stable- and release branches.
But maybe we should get a so@ on boat for that? As a port person I'm
not familiar with the workflow to so such.

Test Plan

make buildworld
Install and using it at run-time.

[kwm]

Upstream commit: http://w1.fi/cgit/hostap/commit/?id=9ed4eee345f85e3025c33c6e20aa25696e341ccd

[dumbbell]

wpa_supplicant is maintained in a vendor branch before being imported into base:
https://svnweb.freebsd.org/base/vendor/wpa/

I suppose your patch needs to go there first, but I never worked with vendor import. @rpaulo will know better :-)

[rpaulo]

If you really must, go ahead and commit this patch, but please understand this code was never compiled in FreeBSD.