libnv: fix heap overflow in nvlist_recv()

[oshogbo]

Summary

nvlist_check_header() validated nvlh_size for overflow before
performing conversion. An mallicous user can set
NV_FLAG_BIG_ENDIAN in the header and craft nvlh_size so that
the orginall value passes the check, but after the conversion the
sizeof(nvlist_header) + size can overflow.
This can lead to a heap buffer overflow.

[markj]

The commit log should include a "Fixes" tag. Presumably it also deserves an SA and a regression test?