MdeModulePkg UsbBusPei: Fix wrong buffer length used to read hub desc
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=973 Bug 973 just mentions UsbBusDxe, but UsbBusPei has similar issue. HUB descriptor has variable length. But the code uses stack (HubDescriptor in PeiDoHubConfig) with fixed length sizeof(EFI_USB_HUB_DESCRIPTOR) to hold HUB descriptor data. It uses hard code length value (12) for SuperSpeed path. And it uses HubDesc->Length for none SuperSpeed path, then there will be stack overflow when HubDesc->Length is greater than sizeof(EFI_USB_HUB_DESCRIPTOR). The patch updates the code to use a big enough buffer to hold the descriptor data. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Ruiyu Ni <ruiyu.ni@intel.com> Cc: Bret Barkelew <bret.barkelew@microsoft.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Star Zeng <star.zeng@intel.com> Reviewed-by: Bret Barkelew <bret.barkelew@microsoft.com>
This commit is contained in:
@@ -1,7 +1,7 @@
|
||||
/** @file
|
||||
Constants definitions for Usb Hub Peim
|
||||
|
||||
Copyright (c) 2006 - 2014, Intel Corporation. All rights reserved.<BR>
|
||||
Copyright (c) 2006 - 2018, Intel Corporation. All rights reserved.<BR>
|
||||
|
||||
This program and the accompanying materials
|
||||
are licensed and made available under the terms and conditions
|
||||
@@ -227,6 +227,7 @@ PeiHubClearHubFeature (
|
||||
Get a given hub descriptor.
|
||||
|
||||
@param PeiServices General-purpose services that are available to every PEIM.
|
||||
@param PeiUsbDevice Indicates the hub controller device.
|
||||
@param UsbIoPpi Indicates the PEI_USB_IO_PPI instance.
|
||||
@param DescriptorSize The length of Hub Descriptor buffer.
|
||||
@param HubDescriptor Caller allocated buffer to store the hub descriptor if
|
||||
@@ -240,6 +241,7 @@ PeiHubClearHubFeature (
|
||||
EFI_STATUS
|
||||
PeiGetHubDescriptor (
|
||||
IN EFI_PEI_SERVICES **PeiServices,
|
||||
IN PEI_USB_DEVICE *PeiUsbDevice,
|
||||
IN PEI_USB_IO_PPI *UsbIoPpi,
|
||||
IN UINTN DescriptorSize,
|
||||
OUT EFI_USB_HUB_DESCRIPTOR *HubDescriptor
|
||||
|
Reference in New Issue
Block a user