MdeModulePkg/UsbBusDxe: Fixed USB descriptor length check

According to spec if the length of a descriptor is smaller than
what the specification defines, then the host shall ignore it.
However if the size is greater than expected the host will ignore
the extra bytes and start looking for the next descriptor
at the end of actual length returned. Original check did not
handle the latter case correctly and only allowed descriptors
with lengths exactly as defined in specification.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Evgeny Yakovlev <insoreiges@gmail.com>
Reviewed-by: Feng Tian <feng.tian@intel.com>

diff --git a/MdeModulePkg/Bus/Usb/UsbBusDxe/UsbDesc.c b/MdeModulePkg/Bus/Usb/UsbBusDxe/UsbDesc.c
index 5b8b1aaeae343e15f1c2f25799f3f08dc3aad876..fba60dae16d72b3e27e61ba86dff462f0901e4f1 100644 (file)
--- a/MdeModulePkg/Bus/Usb/UsbBusDxe/UsbDesc.c
+++ b/MdeModulePkg/Bus/Usb/UsbBusDxe/UsbDesc.c
@@ -199,8 +199,8 @@ UsbCreateDesc (
     }\r
   }\r
 \r
-  if ((Len <= Offset)      || (Len < Offset + DescLen) ||\r
-      (Head->Type != Type) || (Head->Len != DescLen)) {\r
+  if ((Len <= Offset)      || (Len < Offset + Head->Len) ||\r
+      (Head->Type != Type) || (Head->Len < DescLen)) {\r
     DEBUG (( EFI_D_ERROR, "UsbCreateDesc: met mal-format descriptor\n"));\r
     return NULL;\r
   }\r