Acorn421

The `ippon command` function in `drivers/blazer usb.c` partially initializes the `tmp[64]` character array with a short Megatec status query and subsequently passes a fixed eight-byte chunk to `usb control msg()`. A malicious firmware-controlled USB device using Mustek Powermust VID 0x06da and PID 0x0003 can match `blazer usb id` and select `ippon subdriver`, allowing it to receive uninitialized trailing stack bytes during normal polling. This read-only disclosure requires physical or supply-chain access to the USB bus.

A heap out-of-bounds read occurs during ordinary enumeration when a HID peripheral returns a short report descriptor. The USBX host processes the report descriptor sequence by advancing over headers and parsing payloads, but it only verifies if an item fits in the descriptor after the header has been processed and the payload parsed. Furthermore, the analysis does not validate the declared sizes against the actual bytes received.

In the IPv4 PASV path, the FTP Client accepts any address provided in the server's `227` reply. Because validation is limited to parsing and checking for non-zero values, a malicious server can specify an arbitrary address to redirect the Client.

An out-of-bounds heap read occurs in the UVC H.264 extension-unit parser when the system fails to validate the descriptor length before accessing the GUID field. A local attacker using a malicious USB video camera can trigger this read beyond allocated bounds during camera stream setup, resulting in a denial of service.

protobufjs accepts certain schema-derived names that collide with properties used by runtime helpers. Specifically, this occurs with fields named `hasOwnProperty`, field or oneof names such as `$type` when loaded via JSON/reflection descriptors, and service methods that generate a helper name of `rpcCall`. When these types are used, the software may read schema-controlled data instead of the expected own-property helper, reflected type metadata, or base RPC helper. This can lead to deterministic exceptions or recursive calls during decode post-checks, verification, object conversion, reflected JSON serialization, or RPC helper invocation, potentially resulting in a denial of service for the affected processing path.