Input: xpad - fix out-of-bounds access for Share button

In the Linux kernel, the following vulnerability has been resolved:

Input: xpad - fix out-of-bounds access for Share button

xpadone_process_packet() receives len directly from urb->actual_length

and uses it to index the share-button byte at data[len - 18] or

data[len - 26]. Since both len and data[0] are under the device's

control, a broken controller can send a GIP_CMD_INPUT packet with

actual_length < 18 (e.g. 5 bytes) and reach this code path, causing

accesses beyond the actual array.

Fix this by calculating the offset and checking bounds against the

packet length.