tyler.durden
/
audk
mirror of https://github.com/acidanthera/audk.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

MdeModulePkg/UsbBusDxe: Fixed USB descriptor length check 

According to spec if the length of a descriptor is smaller than
what the specification defines, then the host shall ignore it.
However if the size is greater than expected the host will ignore
the extra bytes and start looking for the next descriptor
at the end of actual length returned. Original check did not
handle the latter case correctly and only allowed descriptors
with lengths exactly as defined in specification.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Evgeny Yakovlev <insoreiges@gmail.com>
Reviewed-by: Feng Tian <feng.tian@intel.com>
This commit is contained in:
Evgeny Yakovlev 2016-06-05 22:28:31 +08:00 committed by Feng Tian
parent 848e147239
commit f89f1dbe52
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
MdeModulePkg/Bus/Usb/UsbBusDxe/UsbDesc.c
View File

@ -199,8 +199,8 @@ UsbCreateDesc (
}
}
if ((Len <= Offset) || (Len < Offset + DescLen) ||
(Head->Type != Type) || (Head->Len != DescLen)) {
if ((Len <= Offset) || (Len < Offset + Head->Len) ||
(Head->Type != Type) || (Head->Len < DescLen)) {
DEBUG (( EFI_D_ERROR, "UsbCreateDesc: met mal-format descriptor\n"));
return NULL;
}