diff options
| author | dxbjavid <[email protected]> | 2026-06-12 11:14:18 +0530 |
|---|---|---|
| committer | dxbjavid <[email protected]> | 2026-06-12 11:14:18 +0530 |
| commit | 85047e1777f5c20b7a936aa905c746125d3ed066 (patch) | |
| tree | 5a224762dd15d1856a89d4e25d0540e6531b02c4 /src/class | |
| parent | 5014146fef1aac07362ee35c0c361b8475f7636d (diff) | |
bound item size to remaining length in hid report descriptor parser
Diffstat (limited to 'src/class')
| -rw-r--r-- | src/class/hid/hid_host.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/src/class/hid/hid_host.c b/src/class/hid/hid_host.c index fc7704258..bd419c72d 100644 --- a/src/class/hid/hid_host.c +++ b/src/class/hid/hid_host.c @@ -704,6 +704,10 @@ uint8_t tuh_hid_parse_report_descriptor(tuh_hid_report_info_t* report_info_arr, size = 4; // HID 1.11 6.2.2.2 3 is 4 bytes } + // item data must fit in the remaining descriptor; a truncated item would + // read past the buffer and underflow desc_len below + if (size > desc_len) break; + uint8_t const data8 = (size > 0) ? desc_report[0] : 0; TU_LOG(3, "tag = %d, type = %d, size = %d, data = ", tag, type, size); @@ -738,7 +742,7 @@ uint8_t tuh_hid_parse_report_descriptor(tuh_hid_report_info_t* report_info_arr, switch (tag) { case RI_GLOBAL_USAGE_PAGE: // only take in account the "usage page" before REPORT ID - if (ri_collection_depth == 0) memcpy(&info->usage_page, desc_report, size); + if (ri_collection_depth == 0) memcpy(&info->usage_page, desc_report, TU_MIN(size, sizeof(info->usage_page))); break; case RI_GLOBAL_LOGICAL_MIN: break; |