commit f89f1dbe5205f7bb7878a9e8b9149d3a6a894104
author Evgeny Yakovlev <insoreiges@gmail.com> Sun Jun 05 22:28:31 2016 +0800
committer Feng Tian <feng.tian@intel.com> Wed Jun 29 10:37:22 2016 +0800
tree 02740fe7a0cfc257b92261b7d0925e1b3cf79a25
parent 848e14723964231cc64dfe71342201237979e9fb

MdeModulePkg/UsbBusDxe: Fixed USB descriptor length check

According to spec if the length of a descriptor is smaller than
what the specification defines, then the host shall ignore it.
However if the size is greater than expected the host will ignore
the extra bytes and start looking for the next descriptor
at the end of actual length returned. Original check did not
handle the latter case correctly and only allowed descriptors
with lengths exactly as defined in specification.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Evgeny Yakovlev <insoreiges@gmail.com>
Reviewed-by: Feng Tian <feng.tian@intel.com>

MdeModulePkg/Bus/Usb/UsbBusDxe/UsbDesc.c

diff --git a/MdeModulePkg/Bus/Usb/UsbBusDxe/UsbDesc.c b/MdeModulePkg/Bus/Usb/UsbBusDxe/UsbDesc.c
index 5b8b1aa..fba60da 100644
--- a/MdeModulePkg/Bus/Usb/UsbBusDxe/UsbDesc.c
+++ b/MdeModulePkg/Bus/Usb/UsbBusDxe/UsbDesc.c
@@ -199,8 +199,8 @@
     }

   }

 

-  if ((Len <= Offset)      || (Len < Offset + DescLen) ||

-      (Head->Type != Type) || (Head->Len != DescLen)) {

+  if ((Len <= Offset)      || (Len < Offset + Head->Len) ||

+      (Head->Type != Type) || (Head->Len < DescLen)) {

     DEBUG (( EFI_D_ERROR, "UsbCreateDesc: met mal-format descriptor\n"));

     return NULL;

   }