From 36c1cb09106eab6cebab2e6722c1907ca12bfa19 Mon Sep 17 00:00:00 2001 From: Thomas Faber Date: Wed, 6 Mar 2019 09:22:55 +0100 Subject: [PATCH] [USBPORT] Correctly find interface descriptor in USBPORT_ParseConfigurationDescriptor There can be other descriptors between the config descriptor and the first interface descriptor, so we specifically need to check for the interface descriptor type and skip anything before that. We also need to guard against bLength == 0, which would cause an infinite loop, instead of doing a second bDescriptorType check. --- drivers/usb/usbport/device.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/usbport/device.c b/drivers/usb/usbport/device.c index b28d9ef0154..5662a6141af 100644 --- a/drivers/usb/usbport/device.c +++ b/drivers/usb/usbport/device.c @@ -201,7 +201,7 @@ USBPORT_ParseConfigurationDescriptor(IN PUSB_CONFIGURATION_DESCRIPTOR ConfigDesc *OutAlternate = 0; for (TmpDescriptor = (PUSB_CONFIGURATION_DESCRIPTOR)((ULONG_PTR)ConfigDescriptor + ConfigDescriptor->bLength); - TmpDescriptor->bDescriptorType == USB_CONFIGURATION_DESCRIPTOR_TYPE && TmpDescriptor->bDescriptorType > 0; + TmpDescriptor->bDescriptorType != USB_INTERFACE_DESCRIPTOR_TYPE && TmpDescriptor->bLength > 0; TmpDescriptor = (PUSB_CONFIGURATION_DESCRIPTOR)((ULONG_PTR)TmpDescriptor + TmpDescriptor->bLength)) ;