diff options
| author | reillyg <reillyg@chromium.org> | 2015-04-21 14:26:15 -0700 |
|---|---|---|
| committer | Commit bot <commit-bot@chromium.org> | 2015-04-21 21:27:46 +0000 |
| commit | 27b714610e07588bdf44101fce764672ef8bbb0c (patch) | |
| tree | bd836a66548ceb831ccf843e0c4543927d1635f2 | |
| parent | 569bc2306103c80b1d6e613c30339f69ad9329dd (diff) | |
| download | chromium_src-27b714610e07588bdf44101fce764672ef8bbb0c.zip chromium_src-27b714610e07588bdf44101fce764672ef8bbb0c.tar.gz chromium_src-27b714610e07588bdf44101fce764672ef8bbb0c.tar.bz2 | |
libusb: Check interface and altsetting number are in range.
When assigning endpoints to interfaces check that the interface number
and alternate setting number are within the ranges provided in the
configuration descriptor.
BUG=478857
Review URL: https://codereview.chromium.org/1050823008
Cr-Commit-Position: refs/heads/master@{#326125}
| -rw-r--r-- | third_party/libusb/README.chromium | 1 | ||||
| -rw-r--r-- | third_party/libusb/assign-endpoints-checks.patch | 17 | ||||
| -rw-r--r-- | third_party/libusb/src/libusb/os/windows_usb.c | 6 |
3 files changed, 24 insertions, 0 deletions
diff --git a/third_party/libusb/README.chromium b/third_party/libusb/README.chromium index fc81c05..e74344c 100644 --- a/third_party/libusb/README.chromium +++ b/third_party/libusb/README.chromium @@ -19,3 +19,4 @@ Local Modifications: - upstream-tick147.patch has been applied. - linux-udev.patch has been applied. - composite-hid-close.patch has been applied. +- assign-endpoints-checks.patch has been applied.
\ No newline at end of file diff --git a/third_party/libusb/assign-endpoints-checks.patch b/third_party/libusb/assign-endpoints-checks.patch new file mode 100644 index 0000000..7ed09bd --- /dev/null +++ b/third_party/libusb/assign-endpoints-checks.patch @@ -0,0 +1,17 @@ +diff --git a/third_party/libusb/src/libusb/os/windows_usb.c b/third_party/libusb/src/libusb/os/windows_usb.c +index 259897e..4469992 100644 +--- a/third_party/libusb/src/libusb/os/windows_usb.c ++++ b/third_party/libusb/src/libusb/os/windows_usb.c +@@ -663,6 +663,12 @@ static int windows_assign_endpoints(struct libusb_device_handle *dev_handle, int + return r; + } + ++ if (iface >= conf_desc->bNumInterfaces || ++ altsetting >= conf_desc->interface[iface].num_altsetting) { ++ usbi_dbg("interface %d, altsetting %d out of range", iface, altsetting); ++ return LIBUSB_ERROR_INVALID_PARAM; ++ } ++ + if_desc = &conf_desc->interface[iface].altsetting[altsetting]; + safe_free(priv->usb_interface[iface].endpoint); + diff --git a/third_party/libusb/src/libusb/os/windows_usb.c b/third_party/libusb/src/libusb/os/windows_usb.c index 259897e..4469992 100644 --- a/third_party/libusb/src/libusb/os/windows_usb.c +++ b/third_party/libusb/src/libusb/os/windows_usb.c @@ -663,6 +663,12 @@ static int windows_assign_endpoints(struct libusb_device_handle *dev_handle, int return r; } + if (iface >= conf_desc->bNumInterfaces || + altsetting >= conf_desc->interface[iface].num_altsetting) { + usbi_dbg("interface %d, altsetting %d out of range", iface, altsetting); + return LIBUSB_ERROR_INVALID_PARAM; + } + if_desc = &conf_desc->interface[iface].altsetting[altsetting]; safe_free(priv->usb_interface[iface].endpoint); |