mirror of https://github.com/acidanthera/audk.git
72750e3bf9
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=973 Bug 973 just mentions UsbBusDxe, but UsbBusPei has similar issue. HUB descriptor has variable length. But the code uses stack (HubDescriptor in PeiDoHubConfig) with fixed length sizeof(EFI_USB_HUB_DESCRIPTOR) to hold HUB descriptor data. It uses hard code length value (12) for SuperSpeed path. And it uses HubDesc->Length for none SuperSpeed path, then there will be stack overflow when HubDesc->Length is greater than sizeof(EFI_USB_HUB_DESCRIPTOR). The patch updates the code to use a big enough buffer to hold the descriptor data. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Ruiyu Ni <ruiyu.ni@intel.com> Cc: Bret Barkelew <bret.barkelew@microsoft.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Star Zeng <star.zeng@intel.com> Reviewed-by: Bret Barkelew <bret.barkelew@microsoft.com> |
||
|---|---|---|
| .. | ||
| HubPeim.c | ||
| HubPeim.h | ||
| PeiUsbLib.c | ||
| PeiUsbLib.h | ||
| UsbBusPei.inf | ||
| UsbBusPei.uni | ||
| UsbBusPeiExtra.uni | ||
| UsbIoPeim.c | ||
| UsbPeim.c | ||
| UsbPeim.h | ||