summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorLéo Lam <leo@innovatetechnologi.es>2019-05-03 12:57:43 +0200
committerNathan Hjelm <hjelmn@me.com>2019-07-07 22:00:03 -0600
commit5305df7966eb920291cb2eafad27e5e201edd79b (patch)
treed0881b4f291d49038410a4e6bbc21678bc8966e9
parent028a92e5f4336e3ff99ddef8ae581b116bba6a9b (diff)
downloadlibusb-5305df7966eb920291cb2eafad27e5e201edd79b.tar.gz
windows_winusb: Bounds check interface for check_valid_interface
This prevents a nasty out-of-bounds read and a likely crash when the interface number is invalid. Closes #568 Signed-off-by: Nathan Hjelm <hjelmn@me.com>
-rw-r--r--libusb/os/windows_winusb.c3
-rw-r--r--libusb/version_nano.h2
2 files changed, 4 insertions, 1 deletions
diff --git a/libusb/os/windows_winusb.c b/libusb/os/windows_winusb.c
index e18a723..c7aec1f 100644
--- a/libusb/os/windows_winusb.c
+++ b/libusb/os/windows_winusb.c
@@ -2412,6 +2412,9 @@ static int get_valid_interface(struct libusb_device_handle *dev_handle, int api_
*/
static int check_valid_interface(struct libusb_device_handle *dev_handle, unsigned short interface, int api_id)
{
+ if (interface >= USB_MAXINTERFACES)
+ return -1;
+
struct winusb_device_handle_priv *handle_priv = _device_handle_priv(dev_handle);
struct winusb_device_priv *priv = _device_priv(dev_handle->dev);
diff --git a/libusb/version_nano.h b/libusb/version_nano.h
index 971eaf4..50676e4 100644
--- a/libusb/version_nano.h
+++ b/libusb/version_nano.h
@@ -1 +1 @@
-#define LIBUSB_NANO 11373
+#define LIBUSB_NANO 11374