Can overfitted deep neural networks in adversarial training generalize? – An approximation viewpoint