From 4d3ae0b784e183141c5ffcc7dd9e709b6b4f0d86 Mon Sep 17 00:00:00 2001 From: Andrey Konovalov Date: Thu, 19 Sep 2019 18:48:35 +0200 Subject: executor: handle USB IN requests with wLength == 0 --- pkg/csource/generated.go | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) (limited to 'pkg/csource/generated.go') diff --git a/pkg/csource/generated.go b/pkg/csource/generated.go index b5bdd09c3..a8bebb9a9 100644 --- a/pkg/csource/generated.go +++ b/pkg/csource/generated.go @@ -2325,7 +2325,7 @@ static volatile long syz_usb_control_io(volatile long a0, volatile long a1, vola char* response_data = NULL; uint32 response_length = 0; - if (event.ctrl.bRequestType & USB_DIR_IN) { + if ((event.ctrl.bRequestType & USB_DIR_IN) && event.ctrl.wLength) { NONFAILING(response_found = lookup_control_response(descs, resps, &event.ctrl, &response_data, &response_length)); if (!response_found) { #if USB_DEBUG @@ -2345,20 +2345,23 @@ static volatile long syz_usb_control_io(volatile long a0, volatile long a1, vola response_length = 0; if (event.ctrl.wLength < response_length) response_length = event.ctrl.wLength; + if ((event.ctrl.bRequestType & USB_DIR_IN) && !event.ctrl.wLength) { + response_length = USB_MAX_PACKET_SIZE; + } response.inner.length = response_length; if (response_data) memcpy(&response.data[0], response_data, response_length); else memset(&response.data[0], 0, response_length); - if (event.ctrl.bRequestType & USB_DIR_IN) { + if ((event.ctrl.bRequestType & USB_DIR_IN) && event.ctrl.wLength) { debug("syz_usb_control_io: writing %d bytes\n", response.inner.length); debug_dump_data(&response.data[0], response.inner.length); rv = usb_fuzzer_ep0_write(fd, (struct usb_fuzzer_ep_io*)&response); } else { rv = usb_fuzzer_ep0_read(fd, (struct usb_fuzzer_ep_io*)&response); debug("syz_usb_control_io: read %d bytes\n", response.inner.length); - debug_dump_data(&event.data[0], response.inner.length); + debug_dump_data(&response.data[0], response.inner.length); } if (rv < 0) { debug("syz_usb_control_io: usb_fuzzer_ep0_read/write failed with %d\n", rv); -- cgit mrf-deployment