diff options
| -rw-r--r-- | MdeModulePkg/Bus/Usb/UsbBusPei/UsbPeim.c | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/MdeModulePkg/Bus/Usb/UsbBusPei/UsbPeim.c b/MdeModulePkg/Bus/Usb/UsbBusPei/UsbPeim.c index 86734f2f73..c31247abfe 100644 --- a/MdeModulePkg/Bus/Usb/UsbBusPei/UsbPeim.c +++ b/MdeModulePkg/Bus/Usb/UsbBusPei/UsbPeim.c @@ -817,6 +817,20 @@ PeiUsbGetAllConfiguration ( ConfigDescLength = ConfigDesc->TotalLength;
//
+ // Reject if TotalLength even cannot cover itself.
+ //
+ if (ConfigDescLength < OFFSET_OF (EFI_USB_CONFIG_DESCRIPTOR, TotalLength) + sizeof (ConfigDesc->TotalLength)) {
+ return EFI_DEVICE_ERROR;
+ }
+
+ //
+ // Reject if TotalLength exceeds the PeiUsbDevice->ConfigurationData.
+ //
+ if (ConfigDescLength > sizeof (PeiUsbDevice->ConfigurationData)) {
+ return EFI_DEVICE_ERROR;
+ }
+
+ //
// Then we get the total descriptors for this configuration
//
Status = PeiUsbGetDescriptor (
|