]> git.baikalelectronics.ru Git - uboot.git/commit
projects / uboot.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: b1bc5ba) | patch
usb: gadget: dfu: Fix the unchecked length field
authorVenkatesh Yadav Abbarapu <venkatesh.abbarapu@amd.com>
Thu, 3 Nov 2022 04:07:48 +0000 (09:37 +0530)
committerTom Rini <trini@konsulko.com>
Mon, 21 Nov 2022 14:23:00 +0000 (09:23 -0500)
commit26e83fa4a2c4c8a8a92079835d00db6cc0be7fbc
treed087f00cc8ecaaaae5ea1de5a7a9729141338448tree | snapshot
parentb1bc5baa1eb76250be07a8e3183a4fc56f5d4718commit | diff
usb: gadget: dfu: Fix the unchecked length field

DFU implementation does not bound the length field in USB
DFU download setup packets, and it does not verify that
the transfer direction. Fixing the length and transfer
direction.

CVE-2022-2347

Signed-off-by: Venkatesh Yadav Abbarapu <venkatesh.abbarapu@amd.com>
Reviewed-by: Marek Vasut <marex@denx.de>
drivers/usb/gadget/f_dfu.c diff | blob | history
"Das U-Boot" Source Tree.