[legacy][usbhost] validate device descriptor bLength before full read

Fix #12026

rt_usbh_attatch_instance() reads the 8-byte device descriptor head and then
reuses the device-supplied bLength as the transfer length for the full
descriptor into the 18-byte dev_desc field of the static dev[] array. A
peripheral that reports a larger bLength can overwrite the following
instance fields (cfg_desc, hcd, pipe, intf) with device-controlled bytes,
which are then used as pointers and indirect call targets.

Reject any bLength other than sizeof(struct udevice_descriptor) right after
the head read, so enumeration stops before the full transfer.

Also bound the sibling lengths called out by the same audit:
- the hub class descriptor length must cover the 8-byte head read and fit
  struct uhub_descriptor before the full read;
- hub and HID interrupt transfers clamp the endpoint wMaxPacketSize to the
  8-byte hub/hid buffer instead of trusting the device value.

No device-side changes and no malicious descriptor PoC.

0 files changed, 0 insertions, 0 deletions