diff options
| author | Haithem Rahmani <[email protected]> | 2025-09-15 17:54:05 +0100 |
|---|---|---|
| committer | Haithem Rahmani <[email protected]> | 2025-09-15 17:54:05 +0100 |
| commit | 0b246ac82490441daa615aa90ab88a4456219c58 (patch) | |
| tree | 604b92dd281f1bcf361222ad0fb85e9e8e01b2dd | |
| parent | cfdd55c48a2f44afa55cdb198fe65ddb0c8565ba (diff) | |
Add bounds check for HID report item parsing
| -rw-r--r-- | common/usbx_host_classes/src/ux_host_class_hid_report_descriptor_get.c | 104 |
1 files changed, 62 insertions, 42 deletions
diff --git a/common/usbx_host_classes/src/ux_host_class_hid_report_descriptor_get.c b/common/usbx_host_classes/src/ux_host_class_hid_report_descriptor_get.c index d112510..2e52ba2 100644 --- a/common/usbx_host_classes/src/ux_host_class_hid_report_descriptor_get.c +++ b/common/usbx_host_classes/src/ux_host_class_hid_report_descriptor_get.c @@ -11,8 +11,8 @@ /**************************************************************************/ /**************************************************************************/ -/** */ -/** USBX Component */ +/** */ +/** USBX Component */ /** */ /** HID Class */ /** */ @@ -29,47 +29,47 @@ #include "ux_host_stack.h" -/**************************************************************************/ -/* */ -/* FUNCTION RELEASE */ -/* */ -/* _ux_host_class_hid_report_descriptor_get PORTABLE C */ +/**************************************************************************/ +/* */ +/* FUNCTION RELEASE */ +/* */ +/* _ux_host_class_hid_report_descriptor_get PORTABLE C */ /* 6.1 */ /* AUTHOR */ /* */ /* Chaoqiong Xiao, Microsoft Corporation */ /* */ /* DESCRIPTION */ -/* */ -/* This function gets the report descriptor and analyzes it. */ -/* */ -/* INPUT */ -/* */ -/* hid Pointer to HID class */ -/* length Length of descriptor */ -/* */ -/* OUTPUT */ -/* */ -/* Completion Status */ -/* */ -/* CALLS */ -/* */ -/* _ux_host_class_hid_global_item_parse Parse global item */ -/* _ux_host_class_hid_local_item_parse Parse local item */ -/* _ux_host_class_hid_report_item_analyse Analyze report */ -/* _ux_host_class_hid_resources_free Free HID resources */ -/* _ux_host_stack_transfer_request Process transfer request */ -/* _ux_utility_memory_allocate Allocate memory block */ -/* _ux_utility_memory_free Release memory block */ -/* */ -/* CALLED BY */ -/* */ -/* HID Class */ -/* */ -/* RELEASE HISTORY */ -/* */ -/* DATE NAME DESCRIPTION */ -/* */ +/* */ +/* This function gets the report descriptor and analyzes it. */ +/* */ +/* INPUT */ +/* */ +/* hid Pointer to HID class */ +/* length Length of descriptor */ +/* */ +/* OUTPUT */ +/* */ +/* Completion Status */ +/* */ +/* CALLS */ +/* */ +/* _ux_host_class_hid_global_item_parse Parse global item */ +/* _ux_host_class_hid_local_item_parse Parse local item */ +/* _ux_host_class_hid_report_item_analyse Analyze report */ +/* _ux_host_class_hid_resources_free Free HID resources */ +/* _ux_host_stack_transfer_request Process transfer request */ +/* _ux_utility_memory_allocate Allocate memory block */ +/* _ux_utility_memory_free Release memory block */ +/* */ +/* CALLED BY */ +/* */ +/* HID Class */ +/* */ +/* RELEASE HISTORY */ +/* */ +/* DATE NAME DESCRIPTION */ +/* */ /* 05-19-2020 Chaoqiong Xiao Initial Version 6.0 */ /* 09-30-2020 Chaoqiong Xiao Modified comment(s), */ /* resulting in version 6.1 */ @@ -117,6 +117,20 @@ UINT status; while (length) { + /* Make sure this descriptor has at least the minimum length. */ + if(length < 3) + { + + /* Error trap. */ + _ux_system_error_handler(UX_SYSTEM_LEVEL_THREAD, UX_SYSTEM_CONTEXT_CLASS, UX_DESCRIPTOR_CORRUPTED); + + /* If trace is enabled, insert this event into the trace buffer. */ + UX_TRACE_IN_LINE_INSERT(UX_TRACE_ERROR, UX_DESCRIPTOR_CORRUPTED, descriptor, 0, 0, UX_TRACE_ERRORS, 0, 0) + + /* Return error status. */ + status = (UX_DESCRIPTOR_CORRUPTED); + } + /* Get one item from the report and analyze it. */ _ux_host_class_hid_report_item_analyse(descriptor, &item); @@ -133,7 +147,7 @@ UINT status; status = _ux_host_class_hid_global_item_parse(hid, &item, descriptor); break; - + case UX_HOST_CLASS_HID_TYPE_MAIN: /* This is a main item. */ @@ -145,13 +159,13 @@ UINT status; /* This is a local item. */ status = _ux_host_class_hid_local_item_parse(hid, &item, descriptor); - break; + break; default: /* This is a reserved item, meaning it shouldn't be used! */ - /* Set status to error. The check after this switch statement + /* Set status to error. The check after this switch statement will handle the rest. */ status = UX_DESCRIPTOR_CORRUPTED; break; @@ -165,11 +179,17 @@ UINT status; /* Jump to the next item. */ descriptor += item.ux_host_class_hid_item_report_length; - + /* Verify that the report descriptor is not corrupted. */ - if (length < item.ux_host_class_hid_item_report_length) + if (length < (item.ux_host_class_hid_item_report_length + item.ux_host_class_hid_item_report_format)) { + /* Error trap. */ + _ux_system_error_handler(UX_SYSTEM_LEVEL_THREAD, UX_SYSTEM_CONTEXT_CLASS, UX_DESCRIPTOR_CORRUPTED); + + /* If trace is enabled, insert this event into the trace buffer. */ + UX_TRACE_IN_LINE_INSERT(UX_TRACE_ERROR, UX_DESCRIPTOR_CORRUPTED, descriptor, 0, 0, UX_TRACE_ERRORS, 0, 0) + /* Return error status. */ status = (UX_DESCRIPTOR_CORRUPTED); break; |