MdeModulePkg/XhciDxe:Fix usb desc length check logic

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Feng Tian <feng.tian@intel.com>
Reviewed-by: Evgeny Yakovlev <insoreiges@gmail.com>

diff --git a/MdeModulePkg/Bus/Pci/XhciDxe/XhciSched.c b/MdeModulePkg/Bus/Pci/XhciDxe/XhciSched.c
index c25342dc1f7845ffa919642bdf8bcc7ef6b94ada..1130b6aac14bdbc6718e6d1f1f05fffc7565e091 100644 (file)
--- a/MdeModulePkg/Bus/Pci/XhciDxe/XhciSched.c
+++ b/MdeModulePkg/Bus/Pci/XhciDxe/XhciSched.c
@@ -2596,6 +2596,11 @@ XhcInitializeEndpointContext (
       EpDesc = (USB_ENDPOINT_DESCRIPTOR *)((UINTN)EpDesc + EpDesc->Length);\r
     }\r
 \r
+    if (EpDesc->Length < sizeof (USB_ENDPOINT_DESCRIPTOR)) {\r
+      EpDesc = (USB_ENDPOINT_DESCRIPTOR *)((UINTN)EpDesc + EpDesc->Length);\r
+      continue;\r
+    }\r
+\r
     EpAddr    = (UINT8)(EpDesc->EndpointAddress & 0x0F);\r
     Direction = (UINT8)((EpDesc->EndpointAddress & 0x80) ? EfiUsbDataIn : EfiUsbDataOut);\r
 \r
@@ -2759,6 +2764,11 @@ XhcInitializeEndpointContext64 (
       EpDesc = (USB_ENDPOINT_DESCRIPTOR *)((UINTN)EpDesc + EpDesc->Length);\r
     }\r
 \r
+    if (EpDesc->Length < sizeof (USB_ENDPOINT_DESCRIPTOR)) {\r
+      EpDesc = (USB_ENDPOINT_DESCRIPTOR *)((UINTN)EpDesc + EpDesc->Length);\r
+      continue;\r
+    }\r
+\r
     EpAddr    = (UINT8)(EpDesc->EndpointAddress & 0x0F);\r
     Direction = (UINT8)((EpDesc->EndpointAddress & 0x80) ? EfiUsbDataIn : EfiUsbDataOut);\r
 \r
@@ -2928,6 +2938,11 @@ XhcSetConfigCmd (
       IfDesc = (USB_INTERFACE_DESCRIPTOR *)((UINTN)IfDesc + IfDesc->Length);\r
     }\r
 \r
+    if (IfDesc->Length < sizeof (USB_INTERFACE_DESCRIPTOR)) {\r
+      IfDesc = (USB_INTERFACE_DESCRIPTOR *)((UINTN)IfDesc + IfDesc->Length);\r
+      continue;\r
+    }\r
+\r
     Dci = XhcInitializeEndpointContext (Xhc, SlotId, DeviceSpeed, InputContext, IfDesc);\r
     if (Dci > MaxDci) {\r
       MaxDci = Dci;\r
@@ -3013,6 +3028,11 @@ XhcSetConfigCmd64 (
       IfDesc = (USB_INTERFACE_DESCRIPTOR *)((UINTN)IfDesc + IfDesc->Length);\r
     }\r
 \r
+    if (IfDesc->Length < sizeof (USB_INTERFACE_DESCRIPTOR)) {\r
+      IfDesc = (USB_INTERFACE_DESCRIPTOR *)((UINTN)IfDesc + IfDesc->Length);\r
+      continue;\r
+    }\r
+\r
     Dci = XhcInitializeEndpointContext64 (Xhc, SlotId, DeviceSpeed, InputContext, IfDesc);\r
     if (Dci > MaxDci) {\r
       MaxDci = Dci;\r
@@ -3261,7 +3281,7 @@ XhcSetInterface (
 \r
   IfDesc = (USB_INTERFACE_DESCRIPTOR *)(ConfigDesc + 1);\r
   while ((UINTN) IfDesc < ((UINTN) ConfigDesc + ConfigDesc->TotalLength)) {\r
-    if (IfDesc->DescriptorType == USB_DESC_TYPE_INTERFACE) {\r
+    if ((IfDesc->DescriptorType == USB_DESC_TYPE_INTERFACE) && (IfDesc->Length >= sizeof (USB_INTERFACE_DESCRIPTOR))) {\r
       if (IfDesc->InterfaceNumber == (UINT8) Request->Index) {\r
         if (IfDesc->AlternateSetting == Xhc->UsbDevContext[SlotId].ActiveAlternateSetting[IfDesc->InterfaceNumber]) {\r
           //\r
@@ -3301,6 +3321,11 @@ XhcSetInterface (
         EpDesc = (USB_ENDPOINT_DESCRIPTOR *)((UINTN)EpDesc + EpDesc->Length);\r
       }\r
 \r
+      if (EpDesc->Length < sizeof (USB_ENDPOINT_DESCRIPTOR)) {\r
+        EpDesc = (USB_ENDPOINT_DESCRIPTOR *)((UINTN)EpDesc + EpDesc->Length);\r
+        continue;\r
+      }\r
+\r
       EpAddr    = (UINT8) (EpDesc->EndpointAddress & 0x0F);\r
       Direction = (UINT8) ((EpDesc->EndpointAddress & 0x80) ? EfiUsbDataIn : EfiUsbDataOut);\r
 \r
@@ -3458,7 +3483,7 @@ XhcSetInterface64 (
 \r
   IfDesc = (USB_INTERFACE_DESCRIPTOR *)(ConfigDesc + 1);\r
   while ((UINTN) IfDesc < ((UINTN) ConfigDesc + ConfigDesc->TotalLength)) {\r
-    if (IfDesc->DescriptorType == USB_DESC_TYPE_INTERFACE) {\r
+    if ((IfDesc->DescriptorType == USB_DESC_TYPE_INTERFACE) && (IfDesc->Length >= sizeof (USB_INTERFACE_DESCRIPTOR))) {\r
       if (IfDesc->InterfaceNumber == (UINT8) Request->Index) {\r
         if (IfDesc->AlternateSetting == Xhc->UsbDevContext[SlotId].ActiveAlternateSetting[IfDesc->InterfaceNumber]) {\r
           //\r
@@ -3498,6 +3523,11 @@ XhcSetInterface64 (
         EpDesc = (USB_ENDPOINT_DESCRIPTOR *)((UINTN)EpDesc + EpDesc->Length);\r
       }\r
 \r
+      if (EpDesc->Length < sizeof (USB_ENDPOINT_DESCRIPTOR)) {\r
+        EpDesc = (USB_ENDPOINT_DESCRIPTOR *)((UINTN)EpDesc + EpDesc->Length);\r
+        continue;\r
+      }\r
+\r
       EpAddr    = (UINT8) (EpDesc->EndpointAddress & 0x0F);\r
       Direction = (UINT8) ((EpDesc->EndpointAddress & 0x80) ? EfiUsbDataIn : EfiUsbDataOut);\r
 \r