[PATCH] tools/usb/testusb: reject bLength == 0 before computing read size

[Gu Bin]

testdev_ffs_ifnum() reads a USB interface descriptor from a file: one byte
for bLength, then bLength-1 more bytes into u.buf (a 255-byte stack
buffer). When bLength == 0, (unsigned char)u.buf[0] - 1 is integer-promoted
to the size_t SIZE_MAX, so fread(u.buf + 1, SIZE_MAX, 1, fd) writes as
many bytes as the stream supplies past the end of u.buf, overflowing
the stack. A corrupted or crafted descriptor file triggers this.

Reject bLength < 2 (the smallest valid descriptor length) before the
second fread. Cast to unsigned char so descriptor lengths of 128-255 are
not misread as negative by the signed char comparison.

Fixes: 5bc9661cba04 ("USB: testusb: testusb compatibility with FunctionFS gadget")
Signed-off-by: Gu Bin <gubin@xxxxxxxxxxxxxxxxxxxx>
---
 tools/usb/testusb.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/tools/usb/testusb.c b/tools/usb/testusb.c
index cbaa1b9fdeac..7014c04fa73e 100644
--- a/tools/usb/testusb.c
+++ b/tools/usb/testusb.c
@@ -141,6 +141,8 @@ static int testdev_ffs_ifnum(FILE *fd)
 	for (;;) {
 		if (fread(u.buf, 1, 1, fd) != 1)
 			return -1;
+		if ((unsigned char)u.buf[0] < 2)
+			return -1;
 		if (fread(u.buf + 1, (unsigned char)u.buf[0] - 1, 1, fd) != 1)
 			return -1;
 
-- 
2.55.0.windows.3