]> git.proxmox.com Git - mirror_edk2.git/commit - MdeModulePkg/Bus/Usb/UsbBusPei/UsbPeim.c
MdeModulePkg/UsbBusPei: Fix out-of-bound read access to descriptors
authorRuiyu Ni <ruiyu.ni@intel.com>
Thu, 25 Oct 2018 09:07:12 +0000 (17:07 +0800)
committerRuiyu Ni <ruiyu.ni@intel.com>
Mon, 29 Oct 2018 03:11:02 +0000 (11:11 +0800)
commitc96de1dbaedce11489974c3e977f1de4ec5cfb84
treeb23d8390b8754e5b731b4bc474065cab16a60c50
parent2f6693c283b54666def65e5e0d0b84e48b21cfef
MdeModulePkg/UsbBusPei: Fix out-of-bound read access to descriptors

Today's implementation reads the Type/Length field in the USB
descriptors data without checking whether the offset to read is
beyond the data boundary.

The patch fixes this issue by syncing the fix in commit
4c034bf62cbc1f3c5f4b5df25de97f0f528132b2
*MdeModulePkg/UsbBus: Fix out-of-bound read access to descriptors

ParsedBytes in UsbBusPei.GetExpectedDescriptor() is different from
Consumed in UsbBusDxe.UsbCreateDesc().
ParsedBytes is the offset of found descriptor while Consumed is
offset of next descriptor of found one.

Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Ruiyu Ni <ruiyu.ni@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
MdeModulePkg/Bus/Usb/UsbBusPei/UsbPeim.c
MdeModulePkg/Bus/Usb/UsbBusPei/UsbPeim.h