From 70425456dae16fca23540936c8fb0d2b86776b97 Mon Sep 17 00:00:00 2001 From: Ruiyu Ni Date: Thu, 25 Oct 2018 18:09:46 +0800 Subject: [PATCH] MdeModulePkg/UsbBusPei: Reject descriptor whose length is bad Today's implementation doesn't check whether the length of descriptor is valid before using it. The patch fixes this issue by syncing the similar fix to UsbBusDxe. 70c3c2370a2aefe71cf0f6c1a1e063f7d74e1d79 *MdeModulePkg/UsbBus: Reject descriptor whose length is bad Additionally the patch also rejects the data when length is larger than sizeof (PeiUsbDevice->ConfigurationData). Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Ruiyu Ni Reviewed-by: Star Zeng Cc: Jiewen Yao --- MdeModulePkg/Bus/Usb/UsbBusPei/UsbPeim.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/MdeModulePkg/Bus/Usb/UsbBusPei/UsbPeim.c b/MdeModulePkg/Bus/Usb/UsbBusPei/UsbPeim.c index 86734f2f73..c31247abfe 100644 --- a/MdeModulePkg/Bus/Usb/UsbBusPei/UsbPeim.c +++ b/MdeModulePkg/Bus/Usb/UsbBusPei/UsbPeim.c @@ -816,6 +816,20 @@ PeiUsbGetAllConfiguration ( ConfigDesc = (EFI_USB_CONFIG_DESCRIPTOR *) PeiUsbDevice->ConfigurationData; ConfigDescLength = ConfigDesc->TotalLength; + // + // Reject if TotalLength even cannot cover itself. + // + if (ConfigDescLength < OFFSET_OF (EFI_USB_CONFIG_DESCRIPTOR, TotalLength) + sizeof (ConfigDesc->TotalLength)) { + return EFI_DEVICE_ERROR; + } + + // + // Reject if TotalLength exceeds the PeiUsbDevice->ConfigurationData. + // + if (ConfigDescLength > sizeof (PeiUsbDevice->ConfigurationData)) { + return EFI_DEVICE_ERROR; + } + // // Then we get the total descriptors for this configuration // -- 2.39.2