⬢ DragonFlyBSD Kernel Audit
DF-5584 / fix.diff
← back to finding ↓ download raw
--- a/sys/bus/u4b/usb_parse.c
+++ b/sys/bus/u4b/usb_parse.c
@@ -128,11 +128,21 @@ usb_idesc_foreach(struct usb_config_descriptor *cd,
 	while (1) {
 		id = (struct usb_interface_descriptor *)
 		    usb_desc_foreach(cd, (struct usb_descriptor *)id);
 		if (id == NULL)
 			break;
 		if ((id->bDescriptorType == UDESC_INTERFACE) &&
 		    (id->bLength >= sizeof(*id))) {
-			if (ps->iface_no_last == id->bInterfaceNumber)
+			if (ps->iface_no_last == id->bInterfaceNumber) {
+				/*
+				 * Don't allow more than 256 alternate
+				 * settings to avoid overflowing the
+				 * alternate index which is a 8-bit
+				 * variable.
+				 */
+				if (ps->iface_index_alt == 255) {
+					DPRINTF("Interface(%u) has more than 256 alternate settings\n",
+					    id->bInterfaceNumber);
+					continue;
+				}
 				new_iface = 0;
+			}
 			ps->iface_no_last = id->bInterfaceNumber;
 			break;
 		}
 	}
-- 
Port of upstream FreeBSD commit 6da5df470099fc55f20b03ef364af730e7be4ffe
("Improve handling of alternate settings in the USB stack.", hselasky,
2020-12-15, PR 251856) to the DragonFly tree. Never applied to sys/ by
the audit; validation of this exact hunk upstream is the FreeBSD main +
stable history.