]> git.proxmox.com Git - mirror_edk2.git/commit
MdeModulePkg UsbBusPei: Fix wrong buffer length used to read hub desc
authorStar Zeng <star.zeng@intel.com>
Mon, 25 Jun 2018 08:50:01 +0000 (16:50 +0800)
committerStar Zeng <star.zeng@intel.com>
Wed, 27 Jun 2018 04:38:52 +0000 (12:38 +0800)
commit72750e3bf9174f15c17e78f0f117b5e7311bb49f
tree5cb4e6a73859559453bd57ca9e4ece58103156f5
parentacebdf14c985c5c9f50b37ece0b15ada87767359
MdeModulePkg UsbBusPei: Fix wrong buffer length used to read hub desc

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=973

Bug 973 just mentions UsbBusDxe, but UsbBusPei has similar issue.

HUB descriptor has variable length.
But the code uses stack (HubDescriptor in PeiDoHubConfig) with fixed
length sizeof(EFI_USB_HUB_DESCRIPTOR) to hold HUB descriptor data.
It uses hard code length value (12) for SuperSpeed path.
And it uses HubDesc->Length for none SuperSpeed path, then there will
be stack overflow when HubDesc->Length is greater than
sizeof(EFI_USB_HUB_DESCRIPTOR).

The patch updates the code to use a big enough buffer to hold the
descriptor data.

Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Ruiyu Ni <ruiyu.ni@intel.com>
Cc: Bret Barkelew <bret.barkelew@microsoft.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Bret Barkelew <bret.barkelew@microsoft.com>
MdeModulePkg/Bus/Usb/UsbBusPei/HubPeim.c
MdeModulePkg/Bus/Usb/UsbBusPei/HubPeim.h