Recover host enumeration from zero length descriptors

hathach · Oct 18, 2024 · ebcd706 · ebcd706
1 parent 8b1e40c
commit ebcd706
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 0 deletions.
diff --git a/src/host/usbh.c b/src/host/usbh.c
@@ -1645,6 +1645,13 @@ static bool _parse_configuration_descriptor(uint8_t dev_addr, tusb_desc_configur
       //          desc_iad->bFunctionClass  == desc_itf->bInterfaceClass);
     }
 
+    if ( 0 == tu_desc_len(p_desc) ) {
+      // A zero length descriptor indicates that the wTotalLength field is wrong.
+      // Parsed interfaces should still be usable
+      TU_LOG_USBH("Encountered a zero-length descriptor after %u bytes\r\n", (uint32_t)p_desc - (uint32_t)desc_cfg);
+      break;
+    }
+
     TU_ASSERT( TUSB_DESC_INTERFACE == tu_desc_type(p_desc) );
     tusb_desc_interface_t const* desc_itf = (tusb_desc_interface_t const*) p_desc;
 

diff --git a/src/tusb.c b/src/tusb.c
@@ -255,6 +255,10 @@ uint16_t tu_desc_get_interface_total_len(tusb_desc_interface_t const* desc_itf,
           ((tusb_desc_interface_t const*) p_desc)->bAlternateSetting == 0) {
         break;
       }
+      if (tu_desc_len(p_desc) == 0) {
+        // Escape infinite loop
+        break;
+      }
 
       len += tu_desc_len(p_desc);
       p_desc = tu_desc_next(p_desc);