descriptor: Fix potential offsetting of pointer by too much

This was checking that `size` is at least `LIBUSB_DT_CONFIG_SIZE` (9)
bytes long, but then increments the pointer with `buf +=
header.bLength`. That could end up pointing past of the end of the
buffer. There is a subsequent check that would prevent dereferencing it,
but it's still undefined behaviour to even create such a pointer.

Add a check with a similar pattern as elsewhere in this file.

libusb/descriptor.c

@@ -1334,6 +1334,11 @@ static int parse_iad_array(struct libusb_context *ctx,
  header.bLength);
  return LIBUSB_ERROR_IO;
  }
+ else if (header.bLength > size) {
+ usbi_warn(ctx, "short config descriptor read %d/%u",
+ size, header.bLength);
+ return LIBUSB_ERROR_IO;
+ }
  if (header.bDescriptorType == LIBUSB_DT_INTERFACE_ASSOCIATION)
  iad_array->length++;
  buf += header.bLength;

libusb/version_nano.h

@@ -1 +1 @@
-#define LIBUSB_NANO 11909
+#define LIBUSB_NANO 11910