hostapd: fix NULL pointer dereference in APuP beacon handling

apup_process_beacon() dereferenced the return value of ap_sta_add()
without checking it. ap_sta_add() returns NULL when the station table is
full, when the allocation fails or when accounting_sta_get_id() fails,
so the following read of sta_ret->aid dereferences NULL.

The station table filling up is remotely triggerable. Beacons reach
handle_beacon() on every softmac driver, because hostapd subscribes to
them per wiphy with NL80211_CMD_REGISTER_BEACONS when it starts the AP.
An adjacent station can therefore beacon the target's SSID from
successive spoofed BSSIDs, each of which is added as an APuP peer, until
max_num_sta is reached and hostapd crashes.

CONFIG_APUP=y is set unconditionally in DRIVER_MAKEOPTS, so the code is
compiled into every wpad variant, but the call is gated on
hapd->conf->apup at runtime and wifi-scripts defaults apup to 0. Only
configurations that opt into APuP are affected.

Reported-by: JuliusBairaktaris
Fixes: e80520197c ("hostapd: Add support for APuP")
Assisted-by: Claude:claude-opus-5
Link: https://github.com/openwrt/openwrt/pull/25242
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

package/network/services/hostapd/patches/780-Implement-APuP-Access-Point-Micro-Peering.patch

@@ -164,7 +164,7 @@ Hotfix-by: Sebastian Gottschall https://github.com/mirror/dd-wrt/commit/0c3001a6
  int hostapd_sta_add(struct hostapd_data *hapd,
 --- /dev/null
 +++ b/src/ap/apup.c
-@@ -0,0 +1,169 @@
+@@ -0,0 +1,175 @@
 +/*
 + * hostapd / APuP Access Point Micro Peering
 + *
@@ -219,6 +219,12 @@ Hotfix-by: Sebastian Gottschall https://github.com/mirror/dd-wrt/commit/0c3001a6
 +		return;
 +
 +	sta_ret = ap_sta_add(hapd, mgmt->bssid);
++	if (!sta_ret)
++	{
++		wpa_printf(MSG_INFO,
++		           "apup_process_beacon(...) Failed to add APuP peer");
++		return;
++	}
 +
 +	/* TODO: this has been added just to making compiler happy after breaking
 +	 * changes introduced in 11a607d12 and 7855b6d60 to support