This is an automated email from the ASF dual-hosted git repository. xiaoxiang781216 pushed a commit to branch releases/13.1 in repository https://gitbox.apache.org/repos/asf/nuttx.git
commit b178a3e1f414458758da1976c35e3fe191949fdc Author: chao an <[email protected]> AuthorDate: Thu Oct 29 14:27:46 2026 +0800 drivers/usbhost: Reject zero MBIM bulk packet size The CDC-MBIM transmit path uses the Bulk OUT max packet size to decide whether a zero-length packet is needed. If a malformed endpoint descriptor reports wMaxPacketSize as zero, that calculation becomes a modulo-by-zero operation. Reject Bulk OUT endpoints with a zero max packet size while parsing the MBIM configuration descriptor. Signed-off-by: chao an <[email protected]> --- drivers/usbhost/usbhost_cdcmbim.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/usbhost/usbhost_cdcmbim.c b/drivers/usbhost/usbhost_cdcmbim.c index 15ef7baf471..4325c0fc91e 100644 --- a/drivers/usbhost/usbhost_cdcmbim.c +++ b/drivers/usbhost/usbhost_cdcmbim.c @@ -1399,6 +1399,12 @@ static int usbhost_cfgdesc(FAR struct usbhost_cdcmbim_s *priv, boutdesc.interval = epdesc->interval; boutdesc.mxpacketsize = usbhost_getle16(epdesc->mxpacketsize); + if (boutdesc.mxpacketsize == 0) + { + uerr("ERROR: Invalid zero Bulk OUT packet size\n"); + return -EINVAL; + } + uinfo("Bulk OUT EP addr:%d mxpacketsize:%d\n", boutdesc.addr, boutdesc.mxpacketsize);
