kingkevin
/
espressif_tinyusb
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

OHCI: Fix array out of bounds issue 

If using a USB hub, a request outside the array size can occur

Original line:
ffb257ac17/src/portable/ohci/ohci.h (L162)

It can happen in a few places but one such example is here:
ffb257ac17/src/portable/ohci/ohci.c (L460)

ie. if HUB address is 5, this would be an array index out of bounds on control endpoints as `CFG_TUH_DEVICE_MAX+1` is only 5.

This fix just includes num of hubs in the reserve array size.

Fixing locally fixed this issue.
This commit is contained in:
Ryzee119 2022-01-28 14:02:34 +10:30 committed by GitHub
parent ffb257ac17
commit 453ba529a6
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/portable/ohci/ohci.h
View File

@ -159,7 +159,7 @@ typedef struct TU_ATTR_ALIGNED(256)
struct {
ohci_ed_t ed;
ohci_gtd_t gtd;
}control[CFG_TUH_DEVICE_MAX+1];
}control[CFG_TUH_DEVICE_MAX+CFG_TUH_HUB+1];
// ochi_itd_t itd[OHCI_MAX_ITD]; // itd requires alignment of 32
ohci_ed_t ed_pool[HCD_MAX_ENDPOINT];