CCM MAC Length Stack Buffer Overflow in MbedTLS

FSP versions prior to v6.3.0 contain a stack buffer overflow vulnerability in the SCE AES CCM adaptor (r_sce/aes2/adaptors/r_sce_AES_adapt.c). The HW_SCE_Aes128CcmDecryptFinalSub function copies a caller-provided MAC of length *InData_MACLength into a 16-byte local buffer without verifying the length. When *InData_MACLength > 16, this causes stack buffer overflow of the 16-byte local MAC buffer, potential local memory corruption leading to arbitrary code execution or device crash, and stack corruption that may enable more severe exploits depending on attacker control.