Messages in this thread | | | From | Jaejoong Kim <> | Date | Thu, 21 Sep 2017 10:42:12 +0900 | Subject | Re: usb/hid: slab-out-of-bounds read in usbhid_parse |
| |
Hi Alan
2017-09-21 0:50 GMT+09:00 Alan Stern <stern@rowland.harvard.edu>: > On Wed, 20 Sep 2017, Kim Jaejoong wrote: > >> To. usb & input guys. >> >> While dig this report, i was wondering about bNumDescriptors in HID descriptor. >> HID document from usb.org said, 'this number must be at least one (1) >> as a Report descriptor will always be present.' >> >> There is no mention of the order of class descriptors. Suppose you >> have a HID device with a report descriptor and a physical descriptor. >> >> If you have the following hid descriptor in this case, >> HID descriptor >> bLength: 12 >> bDescriptor Type: HID >> .. skip >> bNumDescriptors: 2 >> bDescriptorType: physical >> bDescriptorLength: any >> bDescriptorType: Report >> bDescriptorLength: any >> >> If the order of the report descriptor is the second as above, >> usbhid_parse () will fail because my patch is only check the first >> bDescriptor Type. >> But If the order of the report descriptor is always first, there is no >> problem. How do you think this? > > The descriptors can appear in any order. You should not assume that > the report descriptor will always come first.
Thanks for clarifying. I will resend patch with modification.
Jaejoong
> > Alan Stern >
| |