[efi] Avoid integer underflow on malformed USB string descriptors

Signed-off-by: Michael Brown <mcb30@ipxe.org>

diff --git a/src/interface/efi/efi_usb.c b/src/interface/efi/efi_usb.c
index bac2d053af5b5dc4ac6b9c4022e59a3268c7ade0..a8c274a57b4929c070c65c938755e825e35138a6 100644 (file)
--- a/src/interface/efi/efi_usb.c
+++ b/src/interface/efi/efi_usb.c
@@ -981,6 +981,12 @@ efi_usb_get_string_descriptor ( EFI_USB_IO_PROTOCOL *usbio, UINT16 language,
                goto err_get_header;
        }
        len = header.len;
+       if ( len < sizeof ( header ) ) {
+               DBGC ( usbdev, "USBDEV %s underlength string %d:%d\n",
+                      usbintf->name, language, index );
+               rc = -EINVAL;
+               goto err_len;
+       }
 
        /* Allocate buffer */
        if ( ( efirc = bs->AllocatePool ( EfiBootServicesData, len,
@@ -1014,6 +1020,7 @@ efi_usb_get_string_descriptor ( EFI_USB_IO_PROTOCOL *usbio, UINT16 language,
  err_get_descriptor:
        bs->FreePool ( buffer );
  err_alloc:
+ err_len:
  err_get_header:
        bs->RestoreTPL ( saved_tpl );
        return EFIRC ( rc );