sysadmin/ipxe
1
0
Fork 0
mirror of https://github.com/ipxe/ipxe synced 2025-12-17 18:11:49 +03:00
Code Issues Packages Projects Releases Wiki Activity

[usb] Avoid integer underflow on malformed string descriptors

Browse Source 
Signed-off-by: Michael Brown <mcb30@ipxe.org>
This commit is contained in:
Michael Brown
2020-10-01 18:26:37 +01:00
parent 7151fa3ffa
commit 7c6fdf57ea
1 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
src/drivers/bus/usb.c
View File

@@ -913,9 +913,15 @@ int usb_get_string_descriptor ( struct usb_device *usb, unsigned int index,
sizeof ( *desc ) ) ) != 0 ) sizeof ( *desc ) ) ) != 0 )
goto err_get_descriptor; goto err_get_descriptor;
/* Copy to buffer */ /* Calculate string length */
if ( desc->header.len < sizeof ( desc->header ) ) {
rc = -EINVAL;
goto err_len;
}
actual = ( ( desc->header.len - sizeof ( desc->header ) ) / actual = ( ( desc->header.len - sizeof ( desc->header ) ) /
sizeof ( desc->character[0] ) ); sizeof ( desc->character[0] ) );
/* Copy to buffer */
for ( i = 0 ; ( ( i < actual ) && ( i < max ) ) ; i++ ) for ( i = 0 ; ( ( i < actual ) && ( i < max ) ) ; i++ )
buf[i] = le16_to_cpu ( desc->character[i] ); buf[i] = le16_to_cpu ( desc->character[i] );
if ( len ) if ( len )
@@ -926,6 +932,7 @@ int usb_get_string_descriptor ( struct usb_device *usb, unsigned int index,
return actual; return actual;
err_len:
err_get_descriptor: err_get_descriptor:
free ( desc ); free ( desc );
err_alloc: err_alloc: