Shannon Baseband Integer Overflow

There is an integer overflow in Shannon Baseband leading to a heap buffer overflow when reassembling IPv4 fragments. According to the debug strings, this corresponding functionality is implemented in SmdtIp4Rx::ProcessFragments function and its callees.

baseband buffer buffer overflow debug fragments function heap buffer overflow integer ipv4 overflow strings