Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-03 03:31:41 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(usb): USB security fixes from esp-usb

Browse Source 
Combination of the following commits:
- https://github.com/espressif/esp-usb/commit/c546816048e449f11c57ca9a1e0541e592d04c07
- https://github.com/espressif/esp-usb/commit/749af3b938aeb95e1c5b4926f2e28eb2fe65f381
- https://github.com/espressif/esp-usb/commit/234ed4e9d404590011ef61826220f403fc52bb54
- https://github.com/espressif/esp-usb/commit/8f7fe7308d39ec69d3d8822691d74f43e71da331
This commit is contained in:
Tomas Rezucha
2026-04-08 12:50:27 +02:00
parent 9c4bbcdace
commit e7b50cd646
4 changed files with 75 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/usb/enum.c
+13 -2
View File
@@ -1,5 +1,5 @@
/*
* SPDX-FileCopyrightText: 2023-2024 Espressif Systems (Shanghai) CO LTD
* SPDX-FileCopyrightText: 2023-2026 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Apache-2.0
*/
@@ -168,7 +168,7 @@ const char *ENUM_TAG = "ENUM";
// ---------------------------- Helpers ----------------------------------------
// -----------------------------------------------------------------------------
#define ENUM_CHECK(cond, ret_val) ({ \
if (!(cond)) { \
if (unlikely(!(cond))) { \
return (ret_val); \
} \
})
@@ -541,6 +541,10 @@ static esp_err_t parse_short_config_desc(void)
usb_transfer_t *ctrl_xfer = &p_enum_driver->constant.urb->transfer;
const usb_config_desc_t *config_desc = (usb_config_desc_t *)(ctrl_xfer->data_buffer + sizeof(usb_setup_packet_t));
// Validate actual received data size to prevent OOB reads
const int actual_data_len = ctrl_xfer->actual_num_bytes - sizeof(usb_setup_packet_t);
ENUM_CHECK(actual_data_len >= ENUM_SHORT_DESC_REQ_LEN, ESP_ERR_INVALID_RESPONSE);
// Check if the returned descriptor is corrupted
if (config_desc->bDescriptorType != USB_B_DESCRIPTOR_TYPE_CONFIGURATION) {
ESP_LOGE(ENUM_TAG, "Short config desc has wrong bDescriptorType");
@@ -577,6 +581,10 @@ static esp_err_t parse_full_config_desc(void)
usb_transfer_t *ctrl_xfer = &p_enum_driver->constant.urb->transfer;
const usb_config_desc_t *config_desc = (usb_config_desc_t *)(ctrl_xfer->data_buffer + sizeof(usb_setup_packet_t));
// Validate actual received data size to prevent OOB reads
const int actual_data_len = ctrl_xfer->actual_num_bytes - sizeof(usb_setup_packet_t);
ENUM_CHECK(actual_data_len >= ENUM_SHORT_DESC_REQ_LEN, ESP_ERR_INVALID_RESPONSE);
// Check if the returned descriptor is corrupted
if (config_desc->bDescriptorType != USB_B_DESCRIPTOR_TYPE_CONFIGURATION) {
ESP_LOGE(ENUM_TAG, "Full config desc has wrong bDescriptorType");
@@ -640,6 +648,9 @@ static esp_err_t parse_langid_table(void)
usb_transfer_t *transfer = &p_enum_driver->constant.urb->transfer;
const usb_str_desc_t *str_desc = (usb_str_desc_t *)(transfer->data_buffer + sizeof(usb_setup_packet_t));
// Validate minimum LANGID descriptor length: header (2 bytes) + at least 1 LANGID entry (2 bytes)
ENUM_CHECK(str_desc->bLength >= (sizeof(usb_str_desc_t) + 2), ESP_ERR_INVALID_RESPONSE);
//Scan the LANGID table for our target LANGID
ret = ESP_ERR_NOT_FOUND;
int langid_table_num_entries = (str_desc->bLength - sizeof(usb_str_desc_t)) / 2; // Each LANGID is 2 bytes