From 2c1bb758e3b61355f50df61b6eb474d90bec2fab Mon Sep 17 00:00:00 2001 From: Sean McBride Date: Sat, 3 Feb 2024 22:32:52 -0500 Subject: [PATCH] descriptor: Fix potential offsetting of pointer by too much This was checking that `size` is at least `LIBUSB_DT_CONFIG_SIZE` (9) bytes long, but then increments the pointer with `buf += header.bLength`. That could end up pointing past of the end of the buffer. There is a subsequent check that would prevent dereferencing it, but it's still undefined behaviour to even create such a pointer. Add a check with a similar pattern as elsewhere in this file. CVE: CVE-2026-23679 CVE-2026-47104 Upstream-Status: Backport [https://github.com/libusb/libusb/commit/016a0de33ac94b19c7772d6c20fbea7fec23bf68] Backport Changes: - The upstream version_nano.h bump is omitted because this is a security backport to libusb 1.0.27, not a version upgrade. (cherry picked from commit 016a0de33ac94b19c7772d6c20fbea7fec23bf68) Signed-off-by: Anil Dongare --- libusb/descriptor.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libusb/descriptor.c b/libusb/descriptor.c index 4623ad1..4862c69 100644 --- a/libusb/descriptor.c +++ b/libusb/descriptor.c @@ -1233,6 +1233,11 @@ static int parse_iad_array(struct libusb_context *ctx, header.bLength); return LIBUSB_ERROR_IO; } + else if (header.bLength > size) { + usbi_warn(ctx, "short config descriptor read %d/%u", + size, header.bLength); + return LIBUSB_ERROR_IO; + } if (header.bDescriptorType == LIBUSB_DT_INTERFACE_ASSOCIATION) iad_array->length++; buf += header.bLength; -- 2.43.7