Skip to content

Commit

Permalink
Fix infinite loop issue in UsbGetFullHidDescriptor (#640)
Browse files Browse the repository at this point in the history
## Description

UsbGetFullHidDescriptor does not check the Descriptor header length and
this might result in an infinite loop if a bad descriptor is passed.

- [ ] Impacts functionality?
- [ ] Impacts security?
- [ ] Breaking change?
- [ ] Includes tests?
- [ ] Includes documentation?
- [x] Backport to release branch?

## How This Was Tested

Tested on Surface devices

## Integration Instructions

N/A
  • Loading branch information
NishanthSanjeevi authored and ProjectMuBot committed Mar 4, 2025
1 parent 3505bce commit 6f0de96
Showing 1 changed file with 6 additions and 0 deletions.
6 changes: 6 additions & 0 deletions HidPkg/UsbHidDxe/UsbHidDxe.c
Original file line number Diff line number Diff line change
Expand Up @@ -697,6 +697,12 @@ UsbGetFullHidDescriptor (
}
}

// Check if the descriptor length is 0
if (DescriptorHeader->Len == 0) {
DEBUG ((DEBUG_ERROR, "[%a] Descriptor length is 0\n", __func__));
break;
}

// move to next descriptor
DescriptorCursor += DescriptorHeader->Len;
DescriptorHeader = (USB_DESC_HEAD *)((UINT8 *)DescriptorBuffer + DescriptorCursor);
Expand Down

0 comments on commit 6f0de96

Please sign in to comment.