usb: host: check that descriptor is in bound before dereferencing

In the while loop parsing descriptors, check that the descriptor is past
the end just before dereferencing it to check if it is seemingly valid.

Signed-off-by: Josuah Demangeon <[email protected]>

Author: Josuah Demangeon

subsys/usb/host/usbh_device.c

@@ -285,7 +285,7 @@ static int parse_configuration_descriptor(struct usb_device *const udev)
 	dhp = (void *)((uint8_t *)udev->cfg_desc + cfg_desc->bLength);
 	desc_end = (void *)((uint8_t *)udev->cfg_desc + cfg_desc->wTotalLength);
 
-	while ((dhp->bDescriptorType != 0 || dhp->bLength != 0) && (void *)dhp < desc_end) {
+	while ((void *)dhp < desc_end && (dhp->bDescriptorType != 0 || dhp->bLength != 0)) {
 		if (dhp->bDescriptorType == USB_DESC_INTERFACE_ASSOC) {
 			iad = (struct usb_association_descriptor *)dhp;
 			LOG_DBG("bFirstInterface %u", iad->bFirstInterface);