[PATCH 2/3] usb: core: strengthen size check in usb_parse_interface()

[Griffin Kroah-Hartman]

Change the size check from size > 0 to size >= sizeof(struct
usb_descriptor_header) in usb_parse_interface().  This prevents a
malicious device from utilizing trailing bytes to incur an OOB read.

This matches the size check in usb_parse_configuration() as well.

Assisted-by: gkh_clanker_t1000
Signed-off-by: Griffin Kroah-Hartman <griffin@xxxxxxxxx>
---
 drivers/usb/core/config.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index 17c93e95945f..91a51cedc1b8 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -623,7 +623,7 @@ static int usb_parse_interface(struct device *ddev, int cfgno,
 
 	/* Parse all the endpoint descriptors */
 	n = 0;
-	while (size > 0) {
+	while (size >= sizeof(struct usb_descriptor_header)) {
 		if (((struct usb_descriptor_header *) buffer)->bDescriptorType
 		     == USB_DT_INTERFACE)
 			break;

-- 
2.55.0