RT-Thread / RT-Thread/rt-thread
_get_string_descriptor in usbdevice_core.c bug
Open
Nobody has claimed this yet.
bug
- Dominant language
- C
- Stars
- 12.2k
- Forks
- 5.4k
- Avg merge
- 4d 12h
- Merged PRs (30d)
- 40
Description
1、usb设备只有在是复合设备时， device->str_intf才不为空，否则为空，非法访问。这里没有判断设备是否是复合设备就使用，太想当然。而且还想使用index来代替判断是否是复合设备，不严谨。
2、当index == 0xee时，index会赋值=6。然而，只有winusb、rndis设备才会有6个字符描述符，其他都是只有5个，势必产生非法访问。
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in usbdevice_core.c at _get_string_descriptor and trace how device->str_intf and the index value are used for composite and non-composite USB devices. Verify the available descriptor count for each device type, then ensure invalid accesses are avoided for non-composite devices and for index 0xee; confirm the affected descriptor lookups no longer read beyond available data.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- embedded-iot
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100