diff options
| author | Evgeny Yakovlev <insoreiges@gmail.com> | 2016-06-05 22:28:31 +0800 |
|---|---|---|
| committer | Feng Tian <feng.tian@intel.com> | 2016-06-29 10:37:22 +0800 |
| commit | f89f1dbe5205f7bb7878a9e8b9149d3a6a894104 (patch) | |
| tree | 02740fe7a0cfc257b92261b7d0925e1b3cf79a25 /MdeModulePkg | |
| parent | 848e14723964231cc64dfe71342201237979e9fb (diff) | |
| download | edk2-f89f1dbe5205f7bb7878a9e8b9149d3a6a894104.tar.gz edk2-f89f1dbe5205f7bb7878a9e8b9149d3a6a894104.tar.bz2 edk2-f89f1dbe5205f7bb7878a9e8b9149d3a6a894104.zip | |
MdeModulePkg/UsbBusDxe: Fixed USB descriptor length check
According to spec if the length of a descriptor is smaller than
what the specification defines, then the host shall ignore it.
However if the size is greater than expected the host will ignore
the extra bytes and start looking for the next descriptor
at the end of actual length returned. Original check did not
handle the latter case correctly and only allowed descriptors
with lengths exactly as defined in specification.
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Evgeny Yakovlev <insoreiges@gmail.com>
Reviewed-by: Feng Tian <feng.tian@intel.com>
Diffstat (limited to 'MdeModulePkg')
| -rw-r--r-- | MdeModulePkg/Bus/Usb/UsbBusDxe/UsbDesc.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/MdeModulePkg/Bus/Usb/UsbBusDxe/UsbDesc.c b/MdeModulePkg/Bus/Usb/UsbBusDxe/UsbDesc.c index 5b8b1aaeae..fba60dae16 100644 --- a/MdeModulePkg/Bus/Usb/UsbBusDxe/UsbDesc.c +++ b/MdeModulePkg/Bus/Usb/UsbBusDxe/UsbDesc.c @@ -199,8 +199,8 @@ UsbCreateDesc ( }
}
- if ((Len <= Offset) || (Len < Offset + DescLen) ||
- (Head->Type != Type) || (Head->Len != DescLen)) {
+ if ((Len <= Offset) || (Len < Offset + Head->Len) ||
+ (Head->Type != Type) || (Head->Len < DescLen)) {
DEBUG (( EFI_D_ERROR, "UsbCreateDesc: met mal-format descriptor\n"));
return NULL;
}
|