Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9eeb88bc authored by Linux Build Service Account's avatar Linux Build Service Account Committed by Gerrit - the friendly Code Review server
Browse files

Merge "USB: core: prevent malicious bNumInterfaces overflow"

parents 4e45fd47 f20f2b33

drivers/usb/core/config.c

+3 −1
Original line number Diff line number Diff line
@@ -432,6 +432,9 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx, 
	unsigned iad_num = 0;



	memcpy(&config->desc, buffer, USB_DT_CONFIG_SIZE);

	nintf = nintf_orig = config->desc.bNumInterfaces;

	config->desc.bNumInterfaces = 0;	// Adjusted later



	if (config->desc.bDescriptorType != USB_DT_CONFIG ||

	    config->desc.bLength < USB_DT_CONFIG_SIZE ||

	    config->desc.bLength > size) {
@@ -445,7 +448,6 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx, 
	buffer += config->desc.bLength;

	size -= config->desc.bLength;



	nintf = nintf_orig = config->desc.bNumInterfaces;

	if (nintf > USB_MAXINTERFACES) {

		dev_warn(ddev, "config %d has too many interfaces: %d, "

		    "using maximum allowed: %d\n",