From 7434d50fda0ed9764056648319876e1032d1e7ba Mon Sep 17 00:00:00 2001 From: Gareth McMullin Date: Sun, 24 Apr 2011 14:28:16 +1200 Subject: Check index bounds on usb string descriptor request. --- lib/usb/usb_standard.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/lib/usb/usb_standard.c b/lib/usb/usb_standard.c index 7bac216..aa92010 100644 --- a/lib/usb/usb_standard.c +++ b/lib/usb/usb_standard.c @@ -98,6 +98,11 @@ static int usb_standard_get_descriptor(struct usb_setup_data *req, if (!_usbd_device.strings) return 0; /* Device doesn't support strings. */ + /* Check that string index is in range */ + for(i = 0; i <= (req->wValue & 0xff); i++) + if(_usbd_device.strings[i] == NULL) + return 0; + sd->bLength = strlen(_usbd_device.strings[req->wValue & 0xff]) * 2 + 2; sd->bDescriptorType = USB_DT_STRING; -- cgit v1.2.3