This is an automated email from the ASF dual-hosted git repository. acassis pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/nuttx.git
commit 8e2711acb4102c419a0512fe24a455e79ba918a1 Author: chao an <[email protected]> AuthorDate: Thu Oct 29 14:27:46 2026 +0800 drivers/usbhost: Reject zero MBIM bulk packet size The CDC-MBIM transmit path uses the Bulk OUT max packet size to decide whether a zero-length packet is needed. If a malformed endpoint descriptor reports wMaxPacketSize as zero, that calculation becomes a modulo-by-zero operation. Reject Bulk OUT endpoints with a zero max packet size while parsing the MBIM configuration descriptor. Signed-off-by: chao an <[email protected]> --- drivers/usbhost/usbhost_cdcmbim.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/usbhost/usbhost_cdcmbim.c b/drivers/usbhost/usbhost_cdcmbim.c index b094715cd31..1f21ee233d8 100644 --- a/drivers/usbhost/usbhost_cdcmbim.c +++ b/drivers/usbhost/usbhost_cdcmbim.c @@ -1399,6 +1399,12 @@ static int usbhost_cfgdesc(FAR struct usbhost_cdcmbim_s *priv, boutdesc.interval = epdesc->interval; boutdesc.mxpacketsize = usbhost_getle16(epdesc->mxpacketsize); + if (boutdesc.mxpacketsize == 0) + { + uerr("ERROR: Invalid zero Bulk OUT packet size\n"); + return -EINVAL; + } + uinfo("Bulk OUT EP addr:%d mxpacketsize:%d\n", boutdesc.addr, boutdesc.mxpacketsize);
