aboutsummaryrefslogtreecommitdiff
path: root/lib/usb
diff options
context:
space:
mode:
authorGareth McMullin2011-04-24 14:28:16 +1200
committerGareth McMullin2011-04-24 14:28:16 +1200
commit7434d50fda0ed9764056648319876e1032d1e7ba (patch)
tree3433ce97ba0d249ab696a5a1daf4d5b40aafac33 /lib/usb
parentcd88855d133c9286fd20caac2b562729258d6f7c (diff)
Check index bounds on usb string descriptor request.
Diffstat (limited to 'lib/usb')
-rw-r--r--lib/usb/usb_standard.c5
1 files changed, 5 insertions, 0 deletions
diff --git a/lib/usb/usb_standard.c b/lib/usb/usb_standard.c
index 7bac216..aa92010 100644
--- a/lib/usb/usb_standard.c
+++ b/lib/usb/usb_standard.c
@@ -98,6 +98,11 @@ static int usb_standard_get_descriptor(struct usb_setup_data *req,
if (!_usbd_device.strings)
return 0; /* Device doesn't support strings. */
+ /* Check that string index is in range */
+ for(i = 0; i <= (req->wValue & 0xff); i++)
+ if(_usbd_device.strings[i] == NULL)
+ return 0;
+
sd->bLength = strlen(_usbd_device.strings[req->wValue & 0xff])
* 2 + 2;
sd->bDescriptorType = USB_DT_STRING;