diff options
| author | Michael Brown | 2020-10-01 19:26:37 +0200 |
|---|---|---|
| committer | Michael Brown | 2020-10-02 00:27:53 +0200 |
| commit | 7c6fdf57eadb382fc86719daf79c7afa78ace530 (patch) | |
| tree | e7e8e2f4f0b749b1210cc2c5713cad0daf930b3f /src/drivers/bus | |
| parent | [efi] Allow DEBUG=efi_wrap to be used independently of a loaded image (diff) | |
| download | ipxe-7c6fdf57eadb382fc86719daf79c7afa78ace530.tar.gz ipxe-7c6fdf57eadb382fc86719daf79c7afa78ace530.tar.xz ipxe-7c6fdf57eadb382fc86719daf79c7afa78ace530.zip | |
[usb] Avoid integer underflow on malformed string descriptors
Signed-off-by: Michael Brown <mcb30@ipxe.org>
Diffstat (limited to 'src/drivers/bus')
| -rw-r--r-- | src/drivers/bus/usb.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/src/drivers/bus/usb.c b/src/drivers/bus/usb.c index fca47fd36..14eabb6b4 100644 --- a/src/drivers/bus/usb.c +++ b/src/drivers/bus/usb.c @@ -913,9 +913,15 @@ int usb_get_string_descriptor ( struct usb_device *usb, unsigned int index, sizeof ( *desc ) ) ) != 0 ) goto err_get_descriptor; - /* Copy to buffer */ + /* Calculate string length */ + if ( desc->header.len < sizeof ( desc->header ) ) { + rc = -EINVAL; + goto err_len; + } actual = ( ( desc->header.len - sizeof ( desc->header ) ) / sizeof ( desc->character[0] ) ); + + /* Copy to buffer */ for ( i = 0 ; ( ( i < actual ) && ( i < max ) ) ; i++ ) buf[i] = le16_to_cpu ( desc->character[i] ); if ( len ) @@ -926,6 +932,7 @@ int usb_get_string_descriptor ( struct usb_device *usb, unsigned int index, return actual; + err_len: err_get_descriptor: free ( desc ); err_alloc: |