francis.wang
4c86c082a2
Combine poky (Yocto scarthgap), meta-openembedded (scarthgap), and meta-openwrt into a single repository. Components: - poky/ Yocto core framework (BitBake + OE-Core) - meta-openembedded/ Community layers (meta-oe, meta-python, meta-networking) - meta-openwrt/ OpenWrt customization layer - setup-env.sh One-click build environment setup - README.md Project documentation
56 lines
2.1 KiB
Diff
56 lines
2.1 KiB
Diff
From 5e80615ebc95c3f57235ab2699b03e45d8071a1c Mon Sep 17 00:00:00 2001
|
|
From: Michael Mann <mmann78@netscape.net>
|
|
Date: Mon, 26 Jan 2026 16:44:58 +0000
|
|
Subject: [PATCH] USB-HID: Bugfix resource exhaustion in
|
|
parse_report_descriptor()
|
|
|
|
Sanity range check was removed in 739666a7f5acc270204980e01b4069caf5060f30, restore it
|
|
|
|
AI-Assisted: no
|
|
Fixes #20972
|
|
|
|
(cherry picked from commit 6f753c79b7c8ac382e6383dfabd7d5be6e2b722c)
|
|
|
|
CVE: CVE-2026-3201
|
|
Upstream-Status: Backport [https://gitlab.com/wireshark/wireshark/-/commit/5e80615ebc95c3f57235ab2699b03e45d8071a1c]
|
|
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
|
|
---
|
|
epan/dissectors/packet-usb-hid.c | 7 ++++++-
|
|
1 file changed, 6 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/epan/dissectors/packet-usb-hid.c b/epan/dissectors/packet-usb-hid.c
|
|
index 9a402ee..a27606a 100644
|
|
--- a/epan/dissectors/packet-usb-hid.c
|
|
+++ b/epan/dissectors/packet-usb-hid.c
|
|
@@ -3675,6 +3675,7 @@ hid_unpack_signed(guint8 *data, unsigned int idx, unsigned int size, gint32 *val
|
|
return FALSE;
|
|
}
|
|
|
|
+#define MAX_REPORT_DESCRIPTOR_COUNT 100000 // Arbitrary
|
|
static gboolean
|
|
parse_report_descriptor(report_descriptor_t *rdesc)
|
|
{
|
|
@@ -3856,7 +3857,7 @@ parse_report_descriptor(report_descriptor_t *rdesc)
|
|
}
|
|
|
|
/* Usage min and max must be on the same page */
|
|
- if (USAGE_PAGE(usage_min) != USAGE_PAGE(usage_max)) {
|
|
+ if (USAGE_PAGE(usage_min) != USAGE_PAGE(usage_max)) {
|
|
goto err;
|
|
}
|
|
|
|
@@ -3864,6 +3865,10 @@ parse_report_descriptor(report_descriptor_t *rdesc)
|
|
goto err;
|
|
}
|
|
|
|
+ if (wmem_array_get_count(field.usages) + usage_max - usage_min >= MAX_REPORT_DESCRIPTOR_COUNT) {
|
|
+ goto err;
|
|
+ }
|
|
+
|
|
/* min and max are inclusive */
|
|
wmem_array_grow(field.usages, usage_max - usage_min + 1);
|
|
for (guint32 j = usage_min; j <= usage_max; j++) {
|
|
--
|
|
2.50.1
|
|
|