Possible read out of bounds

Open
#335 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
38/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Stale
Tech stack
c
Domain
embedded-iot

Research direction

Start in usb/device/dev_lowlevel/dev_lowlevel.c at line 337 and trace how the requested string index 0xEE is used during USB initialization. Check the referenced array bounds and the WCID request path; done means confirming whether an out-of-bounds read is possible and adding coverage or handling that prevents it if confirmed.

Written by the indexing model from the issue text.

Description

Hi, I'm new here. While reading in the low level example for USB I found that in line 337 there might be bug.

Windows asks for the string with index 0xEE during init (because of WCID).

In the current implementation this might lead to a read outside the referenced array. Or am I wrong?

If not I would try to fix that an create a PR.

https://github.com/raspberrypi/pico-examples/blob/1c5d9aa567598e6e3eadf6d7f2d8a9342b44dab4/usb/device/dev_lowlevel/dev_lowlevel.c#L337

Dominant language
C
Stars
3.9k
Forks
1k
Avg merge
1d 16h
Merged PRs (30d)
1

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from raspberrypi/pico-examples

All issues in raspberrypi/pico-examples

Similar issues

More C issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.