francis.wang
4c86c082a2
Combine poky (Yocto scarthgap), meta-openembedded (scarthgap), and meta-openwrt into a single repository. Components: - poky/ Yocto core framework (BitBake + OE-Core) - meta-openembedded/ Community layers (meta-oe, meta-python, meta-networking) - meta-openwrt/ OpenWrt customization layer - setup-env.sh One-click build environment setup - README.md Project documentation
47 lines
1.6 KiB
Diff
47 lines
1.6 KiB
Diff
From 2c1bb758e3b61355f50df61b6eb474d90bec2fab Mon Sep 17 00:00:00 2001
|
|
From: Sean McBride <sean@rogue-research.com>
|
|
Date: Sat, 3 Feb 2024 22:32:52 -0500
|
|
Subject: [PATCH] descriptor: Fix potential offsetting of pointer by too
|
|
much
|
|
|
|
This was checking that `size` is at least `LIBUSB_DT_CONFIG_SIZE` (9)
|
|
bytes long, but then increments the pointer with `buf +=
|
|
header.bLength`. That could end up pointing past of the end of the
|
|
buffer. There is a subsequent check that would prevent dereferencing it,
|
|
but it's still undefined behaviour to even create such a pointer.
|
|
|
|
Add a check with a similar pattern as elsewhere in this file.
|
|
|
|
CVE: CVE-2026-23679 CVE-2026-47104
|
|
Upstream-Status: Backport [https://github.com/libusb/libusb/commit/016a0de33ac94b19c7772d6c20fbea7fec23bf68]
|
|
|
|
Backport Changes:
|
|
- The upstream version_nano.h bump is omitted because this is a security
|
|
backport to libusb 1.0.27, not a version upgrade.
|
|
|
|
(cherry picked from commit 016a0de33ac94b19c7772d6c20fbea7fec23bf68)
|
|
Signed-off-by: Anil Dongare <adongare@cisco.com>
|
|
---
|
|
libusb/descriptor.c | 5 +++++
|
|
1 file changed, 5 insertions(+)
|
|
|
|
diff --git a/libusb/descriptor.c b/libusb/descriptor.c
|
|
index 4623ad1..4862c69 100644
|
|
--- a/libusb/descriptor.c
|
|
+++ b/libusb/descriptor.c
|
|
@@ -1233,6 +1233,11 @@ static int parse_iad_array(struct libusb_context *ctx,
|
|
header.bLength);
|
|
return LIBUSB_ERROR_IO;
|
|
}
|
|
+ else if (header.bLength > size) {
|
|
+ usbi_warn(ctx, "short config descriptor read %d/%u",
|
|
+ size, header.bLength);
|
|
+ return LIBUSB_ERROR_IO;
|
|
+ }
|
|
if (header.bDescriptorType == LIBUSB_DT_INTERFACE_ASSOCIATION)
|
|
iad_array->length++;
|
|
buf += header.bLength;
|
|
--
|
|
2.43.7
|
|
|