mirror of
https://github.com/torvalds/linux.git
synced 2026-07-27 17:47:41 +02:00
find_format_descriptor() walks the class-specific interface extras by
advancing with bLength. It rejects descriptors that extend past the
remaining buffer, but it does not reject descriptor lengths smaller than
a USB descriptor header.
Reject too-short descriptors before using bLength to advance the local
scan. This keeps the UA-101 parser robust against malformed descriptor
data and matches the usual USB descriptor walking rules.
Fixes:
|
||
|---|---|---|
| .. | ||
| Makefile | ||
| ua101.c | ||