kingkevin
/
espressif_tinyusb
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Prevent buffer overflow. 

Signed-off-by: MasterPhi <admin@hifiphile.com>
This commit is contained in:
MasterPhi 2021-06-15 21:16:51 +02:00
parent 54dc694be4
commit 6cc702e9ec
1 changed files with 13 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
src/portable/microchip/samx7x/dcd_samx7x.c
View File

@ -238,8 +238,13 @@ static void dcd_ep_handler(uint8_t ep_ix)
if (int_status & USBHS_DEVEPTISR_RXOUTI) if (int_status & USBHS_DEVEPTISR_RXOUTI)
{ {
xfer_ctl_t *xfer = &xfer_status[0]; xfer_ctl_t *xfer = &xfer_status[0];
if (count) if (count && xfer->total_len)
{ {
uint16_t remain = xfer->total_len - xfer->queued_len;
if (count > remain)
{
count = remain;
}
uint8_t *ptr = EP_GET_FIFO_PTR(0,8); uint8_t *ptr = EP_GET_FIFO_PTR(0,8);
if (xfer->buffer) if (xfer->buffer)
{ {
@ -256,7 +261,7 @@ static void dcd_ep_handler(uint8_t ep_ix)
if ((count < xfer->max_packet_size) || (xfer->queued_len == xfer->total_len)) if ((count < xfer->max_packet_size) || (xfer->queued_len == xfer->total_len))
{ {
// RX COMPLETE // RX COMPLETE
dcd_event_xfer_complete(0, 0, xfer->queued_len, XFER_RESULT_SUCCESS, true); dcd_event_xfer_complete(0, 0, xfer->total_len, XFER_RESULT_SUCCESS, true);
// Disable the interrupt // Disable the interrupt
USBHS->USBHS_DEVEPTIDR[0] = USBHS_DEVEPTIDR_RXOUTEC; USBHS->USBHS_DEVEPTIDR[0] = USBHS_DEVEPTIDR_RXOUTEC;
// Though the host could still send, we don't know. // Though the host could still send, we don't know.
@ -280,8 +285,13 @@ static void dcd_ep_handler(uint8_t ep_ix)
if (int_status & USBHS_DEVEPTISR_RXOUTI) if (int_status & USBHS_DEVEPTISR_RXOUTI)
{ {
xfer_ctl_t *xfer = &xfer_status[ep_ix]; xfer_ctl_t *xfer = &xfer_status[ep_ix];
if (count) if (count && xfer->total_len)
{ {
uint16_t remain = xfer->total_len - xfer->queued_len;
if (count > remain)
{
count = remain;
}
uint8_t *ptr = EP_GET_FIFO_PTR(ep_ix,8); uint8_t *ptr = EP_GET_FIFO_PTR(ep_ix,8);
if (xfer->buffer) if (xfer->buffer)
{ {