diff --git a/src/host/usbh.c b/src/host/usbh.c index a9a692455..a2994cde7 100644 --- a/src/host/usbh.c +++ b/src/host/usbh.c @@ -1654,6 +1654,13 @@ static bool _parse_configuration_descriptor(uint8_t dev_addr, tusb_desc_configur // parse each interfaces while( p_desc < desc_end ) { + if ( 0 == tu_desc_len(p_desc) ) { + // A zero length descriptor indicates that the device is off spec (e.g. wrong wTotalLength). + // Parsed interfaces should still be usable + TU_LOG_USBH("Encountered a zero-length descriptor after %u bytes\r\n", (uint32_t)p_desc - (uint32_t)desc_cfg); + break; + } + uint8_t assoc_itf_count = 1; // Class will always starts with Interface Association (if any) and then Interface descriptor diff --git a/src/tusb.c b/src/tusb.c index 65a850930..85ab1d6ae 100644 --- a/src/tusb.c +++ b/src/tusb.c @@ -258,6 +258,10 @@ uint16_t tu_desc_get_interface_total_len(tusb_desc_interface_t const* desc_itf, p_desc = tu_desc_next(p_desc); while (len < max_len) { + if (tu_desc_len(p_desc) == 0) { + // Escape infinite loop + break; + } // return on IAD regardless of itf count if (tu_desc_type(p_desc) == TUSB_DESC_INTERFACE_ASSOCIATION) { return len;