arduino-libraries / Arduino_USBHostMbed5

Apache License 2.0
4 stars 10 forks source link

Code does not handle 0 length items contained within Configuration Descriptor. #40

Closed KurtE closed 10 months ago

KurtE commented 10 months ago

The code: void USBHost::parseConfDescr(USBDeviceConnected dev, uint8_t conf_descr, uint32_t len, IUSBEnumerator* pEnumerator)

Will hang if a device returns a descriptor, which has 0 length items...

One such device is a keyboard from GIGABYTE. I have one Force K83(might be H83)... Whose descriptor is:

Configuration Descriptor
2400E8F0 - 09 02 54 00 03 01 00 A0  32 09 04 00 00 01 03 01  : ..T..... 2.......
2400E900 - 01 00 09 21 10 01 00 01  22 3B 00 07 05 81 03 08  : ...!.... ";......
2400E910 - 00 08 09 04 01 00 01 03  01 22 51 00 07 05 82 03  : ........ ."Q.....
2400E920 - 10 00 08 09 04 02 00 01  03 00 00 00 09 21 10 01  : ........ .....!..
2400E930 - 00 01 22 25 00 07 05 83  03 10 00 01 00 00 00 00  : .."%.... ........
2400E940 - 00 00 00 00                                       : ....

I ran into this issue on another USBHost implementation that I help support, which is why I have one of these keyboards.

I was able to solve it in my fork/branch by adding test like:

void USBHost::parseConfDescr(USBDeviceConnected * dev, uint8_t * conf_descr, uint32_t len, IUSBEnumerator* pEnumerator)
{
    uint32_t index = 0;
    uint32_t len_desc = 0;
    uint8_t id = 0;
    int nb_endpoints_used = 0;
    USBEndpoint * ep = NULL;
    uint8_t intf_nb = 0;
    bool parsing_intf = false;
    uint8_t current_intf = 0;

    while (index < len) {
        len_desc = conf_descr[index];
        if (len_desc == 0) {
            index++;
            continue;
        }
        id = conf_descr[index+1];
...