Bluetooth: classic: avdtp: missing buffer length check

[lylezhu2012]

Describe the bug
The remaining data length of net buffer needs to be checked before pulling data from it.

To Reproduce
The remaining data length of net buffer needs to be checked before the net_buf_pull_u8 be called.

Such as,

static void avdtp_open_handler(struct bt_avdtp *session,
			struct net_buf *buf, uint8_t msg_type, uint8_t tid)
{
	if (msg_type == BT_AVDTP_CMD) {
		int err = 0;
		struct bt_avdtp_sep *sep;
		struct net_buf *rsp_buf;
		uint8_t error_code = 0;
               
               // Need to check buffer length?
		sep = avdtp_get_sep(net_buf_pull_u8(buf) >> 2);

Expected behavior
The remaining data length of net buffer needs to be checked before pulling data from it.

Impact
Result of exploitation could lead to instability (i.e., crash) or denial of service attacks.

Logs and console output
N/A

Environment (please complete the following information):
N/A

Additional context
N/A