UBSAN: Fix left-shifts of negative values in webusb_descriptors.cc.

device/usb/webusb_descriptors.cc

Index: device/usb/webusb_descriptors.cc
diff --git a/device/usb/webusb_descriptors.cc b/device/usb/webusb_descriptors.cc
index 44a51b893179852733fad4e8f802e070e32d20ab..c21dc6f39c29e4c2cc1617854fa322a9776d9b3c 100644
--- a/device/usb/webusb_descriptors.cc
+++ b/device/usb/webusb_descriptors.cc
@@ -294,7 +294,8 @@ void OnReadWebUsbAllowedOriginsHeader(
     return;
   }
 
-  uint16_t new_length = buffer->data()[2] | (buffer->data()[3] << 8);
+  const uint8_t* data = reinterpret_cast<uint8_t*>(buffer->data());
+  uint16_t new_length = data[2] | (data[3] << 8);
   scoped_refptr<IOBufferWithSize> new_buffer = new IOBufferWithSize(new_length);
   device_handle->ControlTransfer(
       USB_DIRECTION_INBOUND, UsbDeviceHandle::VENDOR, UsbDeviceHandle::DEVICE,
@@ -351,7 +352,8 @@ void OnReadBosDescriptorHeader(scoped_refptr<UsbDeviceHandle> device_handle,
     return;
   }
 
-  uint16_t new_length = buffer->data()[2] | (buffer->data()[3] << 8);
+  const uint8_t* data = reinterpret_cast<uint8_t*>(buffer->data());
+  uint16_t new_length = data[2] | (data[3] << 8);
   scoped_refptr<IOBufferWithSize> new_buffer = new IOBufferWithSize(new_length);
   device_handle->ControlTransfer(
       USB_DIRECTION_INBOUND, UsbDeviceHandle::STANDARD, UsbDeviceHandle::DEVICE,