Merge "USB: core: fix out-of-bounds access bug in usb_get_bos_descriptor()"

	for (i = 0; i < num; i++) {

		buffer += length;

		cap = (struct usb_dev_cap_header *)buffer;

		length = cap->bLength;

		if (total_len < length)

		if (total_len < sizeof(*cap) || total_len < cap->bLength) {

			dev->bos->desc->bNumDeviceCaps = i;

			break;

		}

		length = cap->bLength;

		total_len -= length;

		if (cap->bDescriptorType != USB_DT_DEVICE_CAPABILITY) {