Merge pull request #2852 from GuavTek/recover_zero_length_desc

USBH: Recover from unexpected descriptor size

2 files changed, 11 insertions, 0 deletions

diff --git a/src/host/usbh.c b/src/host/usbh.c
index a9a692455..a2994cde7 100644
--- a/src/host/usbh.c
+++ b/src/host/usbh.c
@@ -1654,6 +1654,13 @@ static bool _parse_configuration_descriptor(uint8_t dev_addr, tusb_desc_configur
 
   // parse each interfaces
   while( p_desc < desc_end ) {
+    if ( 0 == tu_desc_len(p_desc) ) {
+      // A zero length descriptor indicates that the device is off spec (e.g. wrong wTotalLength).
+      // Parsed interfaces should still be usable
+      TU_LOG_USBH("Encountered a zero-length descriptor after %u bytes\r\n", (uint32_t)p_desc - (uint32_t)desc_cfg);
+      break;
+    }
+
     uint8_t assoc_itf_count = 1;
 
     // Class will always starts with Interface Association (if any) and then Interface descriptor
diff --git a/src/tusb.c b/src/tusb.c
index 65a850930..85ab1d6ae 100644
--- a/src/tusb.c
+++ b/src/tusb.c
@@ -258,6 +258,10 @@ uint16_t tu_desc_get_interface_total_len(tusb_desc_interface_t const* desc_itf,
     p_desc = tu_desc_next(p_desc);
 
     while (len < max_len) {
+      if (tu_desc_len(p_desc) == 0) {
+        // Escape infinite loop
+        break;
+      }
       // return on IAD regardless of itf count
       if (tu_desc_type(p_desc) == TUSB_DESC_INTERFACE_ASSOCIATION) {
         return len;