heap-buffer-overflow in megasas_sgl_get_len