From 70c3c2370a2aefe71cf0f6c1a1e063f7d74e1d79 Mon Sep 17 00:00:00 2001 From: Ruiyu Ni Date: Thu, 27 Sep 2018 16:36:05 +0800 Subject: [PATCH] MdeModulePkg/UsbBus: Reject descriptor whose length is bad Today's implementation doesn't check whether the length of descriptor is valid before using it. The patch fixes this issue. Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Ruiyu Ni Cc: Star Zeng Cc: Jiewen Yao Reviewed-by: Star Zeng --- MdeModulePkg/Bus/Usb/UsbBusDxe/UsbDesc.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/MdeModulePkg/Bus/Usb/UsbBusDxe/UsbDesc.c b/MdeModulePkg/Bus/Usb/UsbBusDxe/UsbDesc.c index 70442c57da..9fc6422ab1 100644 --- a/MdeModulePkg/Bus/Usb/UsbBusDxe/UsbDesc.c +++ b/MdeModulePkg/Bus/Usb/UsbBusDxe/UsbDesc.c @@ -772,6 +772,13 @@ UsbGetOneConfig ( DEBUG (( EFI_D_INFO, "UsbGetOneConfig: total length is %d\n", Desc.TotalLength)); + // + // Reject if TotalLength even cannot cover itself. + // + if (Desc.TotalLength < OFFSET_OF (EFI_USB_CONFIG_DESCRIPTOR, TotalLength) + sizeof (Desc.TotalLength)) { + return NULL; + } + Buf = AllocateZeroPool (Desc.TotalLength); if (Buf == NULL) { -- 2.39.2