USB: core: fix out-of-bounds access bug in usb_get_bos_descriptor()