Fix buffer resizing logic in buffer_put_at().

Fix buffer resizing logic in buffer_put_at().

When growing the buffer when it's not big enough for new data, the
current size is doubled repeatedly until it is big enough for the new
data. The required new size is stored in the variable "required",
however the doubling loop exited when the new size was at least
buf->used + len, which might be much smaller than "required" if an
out-of-order packet is received.