DF-5584 / fix.diff
--- a/sys/bus/u4b/usb_parse.c +++ b/sys/bus/u4b/usb_parse.c @@ -128,11 +128,21 @@ usb_idesc_foreach(struct usb_config_descriptor *cd, while (1) { id = (struct usb_interface_descriptor *) usb_desc_foreach(cd, (struct usb_descriptor *)id); if (id == NULL) break; if ((id->bDescriptorType == UDESC_INTERFACE) && (id->bLength >= sizeof(*id))) { - if (ps->iface_no_last == id->bInterfaceNumber) + if (ps->iface_no_last == id->bInterfaceNumber) { + /* + * Don't allow more than 256 alternate + * settings to avoid overflowing the + * alternate index which is a 8-bit + * variable. + */ + if (ps->iface_index_alt == 255) { + DPRINTF("Interface(%u) has more than 256 alternate settings\n", + id->bInterfaceNumber); + continue; + } new_iface = 0; + } ps->iface_no_last = id->bInterfaceNumber; break; } } -- Port of upstream FreeBSD commit 6da5df470099fc55f20b03ef364af730e7be4ffe ("Improve handling of alternate settings in the USB stack.", hselasky, 2020-12-15, PR 251856) to the DragonFly tree. Never applied to sys/ by the audit; validation of this exact hunk upstream is the FreeBSD main + stable history. |