Sync with usb4bsd:

src/lib/libusb20/libusb20_desc.c

Make "libusb20_desc_foreach()" more readable.

src/sys/dev/usb2/controller/*.[ch]
src/sys/dev/usb2/core/*.[ch]

Implement support for USB power save for all HC's.

Implement support for Big-endian EHCI.

Move Huawei quirks back into "u3g" driver.

Improve device enumeration.

src/sys/dev/usb2/ethernet/*[ch]

Patches for supporting new AXE Gigabit chipset.

src/sys/dev/usb2/serial/*[ch]

Fix IOCTL return code.

src/sys/dev/usb2/wlan/*[ch]

Sync with old USB stack.

Submitted by: hps

1 files changed, 28 insertions, 14 deletions

diff --git a/lib/libusb20/libusb20_desc.c b/lib/libusb20/libusb20_desc.c
index bba4d25..e0d2c54 100644
--- a/lib/libusb20/libusb20_desc.c
+++ b/lib/libusb20/libusb20_desc.c
@@ -238,23 +238,37 @@ const uint8_t *
 libusb20_desc_foreach(const struct libusb20_me_struct *pdesc,
     const uint8_t *psubdesc)
 {
-	const void *end;
+	const uint8_t *start;
+	const uint8_t *end;
+	const uint8_t *desc_next;
 
-	if (pdesc == NULL) {
+	/* be NULL safe */
+	if (pdesc == NULL)
 		return (NULL);
-	}
-	end = LIBUSB20_ADD_BYTES(pdesc->ptr, pdesc->len);
 
-	if (psubdesc == NULL) {
-		psubdesc = LIBUSB20_ADD_BYTES(pdesc->ptr, 0);
-	} else {
-		psubdesc = LIBUSB20_ADD_BYTES(psubdesc, psubdesc[0]);
-	}
-	return (((((const void *)psubdesc) >= ((void *)(pdesc->ptr))) &&
-	    (((const void *)psubdesc) < end) &&
-	    (LIBUSB20_ADD_BYTES(psubdesc, psubdesc[0]) >= ((void *)(pdesc->ptr))) &&
-	    (LIBUSB20_ADD_BYTES(psubdesc, psubdesc[0]) <= end) &&
-	    (psubdesc[0] >= 3)) ? psubdesc : NULL);
+	start = (const uint8_t *)pdesc->ptr;
+	end = LIBUSB20_ADD_BYTES(start, pdesc->len);
+
+	/* get start of next descriptor */
+	if (psubdesc == NULL)
+		psubdesc = start;
+	else
+		psubdesc = psubdesc + psubdesc[0];
+
+	/* check that the next USB descriptor is within the range */
+	if ((psubdesc < start) || (psubdesc >= end))
+		return (NULL);		/* out of range, or EOD */
+
+	/* check start of the second next USB descriptor, if any */
+	desc_next = psubdesc + psubdesc[0];
+	if ((desc_next < start) || (desc_next > end))
+		return (NULL);		/* out of range */
+
+	/* check minimum descriptor length */
+	if (psubdesc[0] < 3)
+		return (NULL);		/* too short descriptor */
+
+	return (psubdesc);		/* return start of next descriptor */
 }
 
 /*------------------------------------------------------------------------*