What happens if a device has malformed descriptors?

[ArcaneNibble]

The WebUSB spec has procedures such as "find a list of endpoint descriptors" that involve parsing a device's descriptors. What happens if a device's descriptors are malformed? For example, what if a device declares bNumEndpoints but doesn't follow it with the correct number of endpoint descriptors?

What should happen if WebUSB's interpretation of malformed descriptors ends up diverging from the operating system driver stack's attempts to interpret the same descriptors?

[reillyeon]

Implementations should defer to the operation system as much as possible to avoid this scenario. That said on some platforms the Chromium implementation does have to parse descriptors itself. This danger should be called out in the specification but I'm unsure of anything more we could say normatively.

In the example you give the real bNumEndpoints value isn't exposed to script except by endpoints.length on a USBAlterantiveInterface instance. This forces an implementation to either refuse to enumerate the device entirely or just ignore the mismatch, returning the lesser of bNumEndpoints and the true value.