pxa2xx: avoid buffer overrun on incoming migration

pxa2xx: avoid buffer overrun on incoming migration

CVE-2013-4533

s->rx_level is read from the wire and used to determine how many bytes
to subsequently read into s->rx_fifo[]. If s->rx_level exceeds the
length of s->rx_fifo[] the buffer can be overrun with arbitrary data
from the wire.

Fix this by validating rx_level against the size of s->rx_fifo.

Cc: Don Koch <[email protected]>
Reported-by: Michael Roth <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
Reviewed-by: Peter Maydell <[email protected]>
Reviewed-by: Don Koch <[email protected]>
Signed-off-by: Juan Quintela <[email protected]>