[PATCH 1/3] usb: core: Add size check to find_next_descriptor()

[Griffin Kroah-Hartman]

Add a size check for the descriptor header in find_next_descriptor().
This prevents a scenario where h->blength = 0, causing the while loop to
spin forever.

Assisted-by: gkh_clanker_t1000
Signed-off-by: Griffin Kroah-Hartman <griffin@xxxxxxxxx>
---
 drivers/usb/core/config.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index 45e20c6d76c0..17c93e95945f 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -29,6 +29,8 @@ static int find_next_descriptor(unsigned char *buffer, int size,
 	/* Find the next descriptor of type dt1 or dt2 */
 	while (size > 0) {
 		h = (struct usb_descriptor_header *) buffer;
+		if (h->bLength < sizeof(struct usb_descriptor_header))
+			break;
 		if (h->bDescriptorType == dt1 || h->bDescriptorType == dt2)
 			break;
 		buffer += h->bLength;

-- 
2.55.0