[nrf fromtree] Bluetooth: Host: Validate periodic advertising report length

The periodic advertising report handler checks that the event header is
present and that the data fits in the reassembly buffer, but not that
the event actually carries as many data bytes as its length field
claims. With CONFIG_BT_PER_ADV_SYNC_BUF_SIZE > 0, a report with a
length field larger than the remaining event payload makes
net_buf_simple_add_mem() copy up to 255 bytes from beyond the end of
the HCI event buffer into the reassembly buffer, and the result is
passed on to the application.

Drop such reports the same way as reports that do not fit in the
reassembly buffer.

Fixes #117587

Assisted-by: Claude:claude-fable-5
Signed-off-by: Johan Hedberg <johan.hedberg@silabs.com>

(cherry picked from commit e9c3252)

Author: jhedberg

subsys/bluetooth/host/scan.c

@@ -1105,6 +1105,16 @@ static void bt_hci_le_per_adv_report_common(struct net_buf *buf)
 
 	if (!per_adv_sync->report_truncated) {
 #if CONFIG_BT_PER_ADV_SYNC_BUF_SIZE > 0
+		if (evt->length > buf->len) {
+			/* The event does not carry the data it claims. Drop the report */
+			LOG_WRN("Periodic adv report corrupted (wants %u out of %u)", evt->length,
+				buf->len);
+
+			per_adv_sync->report_truncated = true;
+			net_buf_simple_reset(&per_adv_sync->reassembly);
+			return;
+		}
+
 		if (net_buf_simple_tailroom(&per_adv_sync->reassembly) < evt->length) {
 			/* The buffer is too small for the entire report. Drop it */
 			LOG_WRN("Buffer is too small to reassemble the report. "