* grub-core/bus/usb/usb.c (grub_usb_device_initialize): Add condition

	to break endless loop.

diff --git a/ChangeLog b/ChangeLog
index 5afeded9cb5f86ab28007ba0104621746ea5cfeb..f058d12664041c55090c8a14a84ce75d39a5c99f 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2013-09-18  Melki Christian  <Christian.melki@saabgroup.com>
+
+       * grub-core/bus/usb/usb.c (grub_usb_device_initialize): Add condition
+       to break endless loop.
+
 2013-08-23  Vladimir Serbinenko  <phcoder@gmail.com>
 
        * util/grub-fstest.c: Fix several printf formats.

diff --git a/grub-core/bus/usb/usb.c b/grub-core/bus/usb/usb.c
index 024190eafef9e9e92c10ac3a4554efb7453b4630..8da5e4c7491b55df25c01e420700f7d76b583051 100644 (file)
--- a/grub-core/bus/usb/usb.c
+++ b/grub-core/bus/usb/usb.c
@@ -148,6 +148,7 @@ grub_usb_device_initialize (grub_usb_device_t dev)
       int pos;
       int currif;
       char *data;
+      struct grub_usb_desc *desc;
 
       /* First just read the first 4 bytes of the configuration
         descriptor, after that it is known how many bytes really have
@@ -174,18 +175,35 @@ grub_usb_device_initialize (grub_usb_device_t dev)
       /* Read all interfaces.  */
       for (currif = 0; currif < dev->config[i].descconf->numif; currif++)
        {
-         while (pos < config.totallen
-                && ((struct grub_usb_desc *)&data[pos])->type
-                != GRUB_USB_DESCRIPTOR_INTERFACE)
-           pos += ((struct grub_usb_desc *)&data[pos])->length;
+         while (pos < config.totallen)
+            {
+              desc = (struct grub_usb_desc *)&data[pos];
+              if (desc->type == GRUB_USB_DESCRIPTOR_INTERFACE)
+                break;
+              if (!desc->length)
+                {
+                  err = GRUB_USB_ERR_BADDEVICE;
+                  goto fail;
+                }
+              pos += desc->length;
+            }
+
          dev->config[i].interf[currif].descif
            = (struct grub_usb_desc_if *) &data[pos];
          pos += dev->config[i].interf[currif].descif->length;
 
-         while (pos < config.totallen
-                && ((struct grub_usb_desc *)&data[pos])->type
-                != GRUB_USB_DESCRIPTOR_ENDPOINT)
-           pos += ((struct grub_usb_desc *)&data[pos])->length;
+         while (pos < config.totallen)
+            {
+              desc = (struct grub_usb_desc *)&data[pos];
+              if (desc->type == GRUB_USB_DESCRIPTOR_ENDPOINT)
+                break;
+              if (!desc->length)
+                {
+                  err = GRUB_USB_ERR_BADDEVICE;
+                  goto fail;
+                }
+              pos += desc->length;
+            }
 
          /* Point to the first endpoint.  */
          dev->config[i].interf[currif].descendp