Can you make this into a range comparison, using char * instead void * ?

Same here.

Why are you not checking dlen >= XXXX ?

Do I need to? We've already validated the length for the type of capability block, then consumers of this are expected to traverse it with something generally like:

struct libusb_bos_dev_capability_descriptor *check = ptr->dev_capability;
int read = 0;
while (read < ptr->bNumDeviceCapabilities) {
    ++read;
    ...
    check = (char *)check + check->bLength;
}

so we point to the earliest (w.r.t memory layout) capability and the consumer sorts it out by length.

Why does a smaller pointer value indicate ss_cap should override the existing value? I don't understand this.

This should read:

ptr->dev_capability = calloc(ptr->bNumDeviceCapabilities, sizeof(ptr->dev_capability[0]));

According to Linux's LibUSB ???

Make sure this structure is freed.

Be very careful to verify all descriptor lengths.

From what I can see, this change is not compatible to what libusb from Linux does.

https://github.com/libusb/libusb/blob/master/libusb/descriptor.c#L868

Can you show me a link to that parsing code?

Correcting myself, dev_capability should be a double pointer, so my example above is not 100% correct.

To address this comment and your new comment further down:

I was attempting to avoid revamping the way we currently read these capabilities for two reasons:

• Make it easier to verify correctness of change, and
• Minimize havoc wreaked upon consumers of our current libusb for the time being

Linux libusb is more flexible than ours; we only allow up to two capabilities, one for USB 2.0 and one for USB SS, and we keep pointers to these in the BOS descriptor and their memory is allocated at the same time as the descriptor itself (See: line 458 just above this, along with the following two lines right here).

These two members aren't easily removed, so for the time being add the new member as a compatibility shim between new style and old way to access these things. I could go ahead and rewrite these bits to allocate new memory for each capability.

Double pointer? =( I missed this, because it's not annotated that way in their header: https://github.com/libusb/libusb/blob/master/libusb/libusb.h#L763

Yeah, so, that was a contrived example based off of https://github.com/libusb/libusb/blob/master/examples/testlibusb.c#L113 and having clearly missed the [0] index.