MdeModulePkg/Usb: Make sure data from HW is no more than expected

Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Ruiyu Ni <ruiyu.ni@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Star Zeng <star.zeng@intel.com>
Cc: Hao A Wu <hao.a.wu@intel.com>
Reviewed-by: Hao Wu <hao.a.wu@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>
This commit is contained in:
Ruiyu Ni 2018-08-02 09:57:17 +08:00
parent 70c3c2370a
commit 7fb7259fc0
3 changed files with 16 additions and 9 deletions

View File

@ -1009,9 +1009,12 @@ EhcMonitorAsyncRequests (
ProcBuf = NULL;
if (Urb->Result == EFI_USB_NOERROR) {
ASSERT (Urb->Completed <= Urb->DataLen);
ProcBuf = AllocatePool (Urb->Completed);
//
// Make sure the data received from HW is no more than expected.
//
if (Urb->Completed <= Urb->DataLen) {
ProcBuf = AllocatePool (Urb->Completed);
}
if (ProcBuf == NULL) {
EhcUpdateAsyncRequest (Ehc, Urb);

View File

@ -2,7 +2,7 @@
The EHCI register operation routines.
Copyright (c) 2007 - 2013, Intel Corporation. All rights reserved.<BR>
Copyright (c) 2007 - 2018, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD License
which accompanies this distribution. The full text of the license may be found at
@ -1001,11 +1001,12 @@ UhciMonitorAsyncReqList (
//
// Copy the data to temporary buffer if there are some
// data transferred. We may have zero-length packet
// data transferred. We may have zero-length packet.
// Make sure the data received from HW is no more than expected.
//
Data = NULL;
if (QhResult.Complete != 0) {
if ((QhResult.Complete != 0) && (QhResult.Complete <= AsyncReq->DataLen)) {
Data = AllocatePool (QhResult.Complete);
if (Data == NULL) {

View File

@ -1556,9 +1556,12 @@ XhcMonitorAsyncRequests (
//
ProcBuf = NULL;
if (Urb->Result == EFI_USB_NOERROR) {
ASSERT (Urb->Completed <= Urb->DataLen);
ProcBuf = AllocateZeroPool (Urb->Completed);
//
// Make sure the data received from HW is no more than expected.
//
if (Urb->Completed <= Urb->DataLen) {
ProcBuf = AllocateZeroPool (Urb->Completed);
}
if (ProcBuf == NULL) {
XhcUpdateAsyncRequest (Xhc, Urb);