VUSB: Corrected control transfer size check miscalculation (see bugref:11118).

MichalN-O · MichalN-O · commit e13444b7c4ef · 2026-07-14T11:50:33.000Z
svn:sync-xref-src-repo-rev: r174532
diff --git a/src/VBox/Devices/USB/VUSBUrb.cpp b/src/VBox/Devices/USB/VUSBUrb.cpp
@@ -1,4 +1,4 @@
-/* $Id: VUSBUrb.cpp 112702 2026-01-26 16:00:13Z michal.necasek@oracle.com $ */
+/* $Id: VUSBUrb.cpp 114696 2026-07-14 11:50:33Z michal.necasek@oracle.com $ */
 /** @file
  * Virtual USB - URBs.
  */
@@ -976,11 +976,15 @@ static int vusbUrbSubmitCtrl(PVUSBURB pUrb)
                     LogFlow(("%s: vusbUrbSubmitCtrl: Adjusting DATA request: %d -> %d\n", pUrb->pszDesc, pUrb->cbData, cbLeft));
                     pUrb->cbData = cbLeft >= 0 ? (uint32_t)cbLeft : 0;
                 }
-                /* In the host -> direction it's undefined what happens if the host provides
-                   more data than what wLength inidicated.  However, in 2007, iPhone detection
-                   via iTunes would issue wLength=0 but provide a data URB which we needed to
-                   pass on to the device anyway, so we'll just quietly adjust wLength if it's
-                   zero and get on with the work.
+                /* In the host -> device direction it's "undefined" what happens if the host
+                   provides more data than what wLength indicated. The USB specification is
+                   clear that the data phase length must match wLength, but this does not appear
+                   to have been enforced. The xHCI specification explicitly says that that the
+                   spec may need to be violated for compatibility with some devices.
+                    The Apple Mobile Device support version 1.1.1.1 (shipped with iTunes 7.4.3)
+                   is one known offender; as soon as an iPhone is plugged in, the guest issues
+                   a control transfer with wLength=0 but an 8-byte data buffer. We'll just quietly
+                   adjust wLength if it's zero and get on with life.
 
                    What confuses me (bird) here, though, is that we've already sent the SETUP
                    URB to the device when we received it, and all we end up doing is an
@@ -992,7 +996,7 @@ static int vusbUrbSubmitCtrl(PVUSBURB pUrb)
                    P.S.  We used to have a very strange (pUrb->cbData % pSetup->wLength) == 0
                          thing too that joined the pUrb->cbData adjusting above. */
                 else if (   pSetup->wLength == 0
-                         && pUrb->cbData <= pExtra->cbMax)
+                         && pUrb->cbData <= (pExtra->cbMax - sizeof(VUSBSETUP)))
                 {
                     Log(("%s: vusbUrbSubmitCtrl: pAdjusting wLength: %u -> %u (iPhone hack)\n",
                          pUrb->pszDesc, pSetup->wLength, pUrb->cbData));
