usb: Handle audio extension endpoint descriptor in usb_parse_config()

Normal endpoint descriptor size is 7, but for audio extension it is 9. Handle that correctly when parsing endpoint descriptor. Signed-off-by: Bin Meng <bmeng.cn@gmail.com>

usb: Handle audio extension endpoint descriptor in usb_parse_config()
Normal endpoint descriptor size is 7, but for audio extension it is 9. Handle that correctly when parsing endpoint descriptor. Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
Bin Meng · Marek Vasut
1 parent 8a0e6d8307
Showing 1 changed file with 3 additions and 2 deletions Side-by-side Diff
common/usb.c
@@ -437,12 +437,13 @@
 			}
 			break;
 		case USB_DT_ENDPOINT:
-			if (head->bLength != USB_DT_ENDPOINT_SIZE) {
+			if (head->bLength != USB_DT_ENDPOINT_SIZE &&
+			    head->bLength != USB_DT_ENDPOINT_AUDIO_SIZE) {
 				printf("ERROR: Invalid USB EP length (%d)\n",
 					head->bLength);
 				break;
 			}
-			if (index + USB_DT_ENDPOINT_SIZE >
+			if (index + head->bLength >
 			    dev->config.desc.wTotalLength) {
 				puts("USB EP descriptor overflowed buffer!\n");
 				break;
...	...	@@ -437,12 +437,13 @@
437	437	}
438	438	break;
439	439	case USB_DT_ENDPOINT:
440		- if (head->bLength != USB_DT_ENDPOINT_SIZE) {
	440	+ if (head->bLength != USB_DT_ENDPOINT_SIZE &&
	441	+ head->bLength != USB_DT_ENDPOINT_AUDIO_SIZE) {
441	442	printf("ERROR: Invalid USB EP length (%d)\n",
442	443	head->bLength);
443	444	break;
444	445	}
445		- if (index + USB_DT_ENDPOINT_SIZE >
	446	+ if (index + head->bLength >
446	447	dev->config.desc.wTotalLength) {
447	448	puts("USB EP descriptor overflowed buffer!\n");
448	449	break;