narenas
/
opengnsys_ipxe
mirror of https://github.com/ipxe/ipxe.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

[usb] Avoid integer underflow on malformed string descriptors 

Signed-off-by: Michael Brown <mcb30@ipxe.org>
pull/154/head
Michael Brown 2020-10-01 18:26:37 +01:00
parent 7151fa3ffa
commit 7c6fdf57ea
1 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/drivers/bus/usb.c
View File

@ -913,9 +913,15 @@ int usb_get_string_descriptor ( struct usb_device *usb, unsigned int index,
sizeof ( *desc ) ) ) != 0 )
goto err_get_descriptor;
/* Copy to buffer */
/* Calculate string length */
if ( desc->header.len < sizeof ( desc->header ) ) {
rc = -EINVAL;
goto err_len;
}
actual = ( ( desc->header.len - sizeof ( desc->header ) ) /
sizeof ( desc->character[0] ) );
/* Copy to buffer */
for ( i = 0 ; ( ( i < actual ) && ( i < max ) ) ; i++ )
buf[i] = le16_to_cpu ( desc->character[i] );
if ( len )
@ -926,6 +932,7 @@ int usb_get_string_descriptor ( struct usb_device *usb, unsigned int index,
return actual;
err_len:
err_get_descriptor:
free ( desc );
err_alloc: