diff options
| -rw-r--r-- | src/host/usbh.c | 7 | ||||
| -rw-r--r-- | src/tusb.c | 4 |
2 files changed, 11 insertions, 0 deletions
diff --git a/src/host/usbh.c b/src/host/usbh.c index b5df29f50..1b45fd1be 100644 --- a/src/host/usbh.c +++ b/src/host/usbh.c @@ -1645,6 +1645,13 @@ static bool _parse_configuration_descriptor(uint8_t dev_addr, tusb_desc_configur // desc_iad->bFunctionClass == desc_itf->bInterfaceClass); } + if ( 0 == tu_desc_len(p_desc) ) { + // A zero length descriptor indicates that the wTotalLength field is wrong. + // Parsed interfaces should still be usable + TU_LOG_USBH("Encountered a zero-length descriptor after %u bytes\r\n", (uint32_t)p_desc - (uint32_t)desc_cfg); + break; + } + TU_ASSERT( TUSB_DESC_INTERFACE == tu_desc_type(p_desc) ); tusb_desc_interface_t const* desc_itf = (tusb_desc_interface_t const*) p_desc; diff --git a/src/tusb.c b/src/tusb.c index e6f8055b7..799ffdce9 100644 --- a/src/tusb.c +++ b/src/tusb.c @@ -255,6 +255,10 @@ uint16_t tu_desc_get_interface_total_len(tusb_desc_interface_t const* desc_itf, ((tusb_desc_interface_t const*) p_desc)->bAlternateSetting == 0) { break; } + if (tu_desc_len(p_desc) == 0) { + // Escape infinite loop + break; + } len += tu_desc_len(p_desc); p_desc = tu_desc_next(p_desc); |