USB Host PTP 32-Bit Array Length Out-of-Bounds Write

STM32Cube USB Host Library 3.5.4 and earlier trusts device-supplied lengths while decoding PTP 32-bit arrays into fixed-size destination arrays. A malicious PTP/MTP device can return oversized Storage ID or Object Handle arrays and trigger out-of-bounds writes, causing memory corruption or a host crash. ST fixed the issue in USB Host Library 3.5.5.