fix(core/usbh_core): Fix raw_config_desc heap out of bounds

CutClassH · sakumisu · commit d0fac3260a17 · 2024-09-16T23:11:45.000+08:00
diff --git a/core/usbh_core.c b/core/usbh_core.c
@@ -486,7 +486,7 @@ int usbh_enumerate(struct usbh_hubport *hport)
         goto errout;
     }
     USB_LOG_INFO("The device has %d interfaces\r\n", ((struct usb_configuration_descriptor *)ep0_request_buffer[hport->bus->busid])->bNumInterfaces);
-    hport->raw_config_desc = usb_osal_malloc(wTotalLength);
+    hport->raw_config_desc = usb_osal_malloc(wTotalLength + 1);
     if (hport->raw_config_desc == NULL) {
         ret = -USB_ERR_NOMEM;
         USB_LOG_ERR("No memory to alloc for raw_config_desc\r\n");

Original file line number	Diff line number	Diff line change
`@@ -486,7 +486,7 @@ int usbh_enumerate(struct usbh_hubport *hport)`
`486`	`486`	`goto errout;`
`487`	`487`	`}`
`488`	`488`	`USB_LOG_INFO("The device has %d interfaces\r\n", ((struct usb_configuration_descriptor *)ep0_request_buffer[hport->bus->busid])->bNumInterfaces);`
`489`		`- hport->raw_config_desc = usb_osal_malloc(wTotalLength);`
	`489`	`+ hport->raw_config_desc = usb_osal_malloc(wTotalLength + 1);`
`490`	`490`	`if (hport->raw_config_desc == NULL) {`
`491`	`491`	`ret = -USB_ERR_NOMEM;`
`492`	`492`	`USB_LOG_ERR("No memory to alloc for raw_config_desc\r\n");`