shadps4-emu/archived-ext-libusb
1
0
Fork 0
mirror of https://github.com/shadps4-emu/ext-libusb.git synced 2026-01-31 00:55:21 +01:00
Code Issues Packages Projects Releases Wiki Activity

descriptor: Guard against corrupted descriptor length field

Browse Source 
A messed-up descriptor could potentially cause an infinite loop.

Also applied to an instance in the Linux backend.

Closes #1308

[Tormod: Rephrase error messages]
Signed-off-by: Tormod Volden <debian.tormod@gmail.com>
This commit is contained in:
Addison Crump
2023-09-17 08:33:52 +02:00
committed by Tormod Volden
parent 4b732d9422
commit 24d79282af
3 changed files with 12 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
libusb/descriptor.c
View File

@@ -1220,6 +1220,11 @@ static int parse_iad_array(struct libusb_context *ctx,
iad_array->length = 0;
while (consumed < size) {
parse_descriptor(buf, "bb", &header);
if (header.bLength < 2) {
usbi_err(ctx, "invalid descriptor bLength %d",
header.bLength);
return LIBUSB_ERROR_IO;
}
if (header.bDescriptorType == LIBUSB_DT_INTERFACE_ASSOCIATION)
iad_array->length++;
buf += header.bLength;

7
libusb/os/linux_usbfs.c
View File

@@ -652,7 +652,7 @@ static int seek_to_next_config(struct libusb_context *ctx,
while (len > 0) {
if (len < 2) {
usbi_err(ctx, "short descriptor read %zu/2", len);
usbi_err(ctx, "remaining descriptor length too small %zu/2", len);
return LIBUSB_ERROR_IO;
}
@@ -660,6 +660,11 @@ static int seek_to_next_config(struct libusb_context *ctx,
if (header->bDescriptorType == LIBUSB_DT_CONFIG)
return offset;
if (header->bLength < 2) {
usbi_err(ctx, "invalid descriptor bLength %hhu", header->bLength);
return LIBUSB_ERROR_IO;
}
if (len < header->bLength) {
usbi_err(ctx, "bLength overflow by %zu bytes",
(size_t)header->bLength - len);

2
libusb/version_nano.h
View File

@@ -1 +1 @@
#define LIBUSB_NANO 11811
#define LIBUSB_NANO 11812