cherryusb.git/core, branch dev

fix(security): check array overflow

2026-10-23T10:29:36Z

Signed-off-by: sakumisu <1203593632@qq.com>

feat: add register driver api, support multi host & device with different ip

2026-09-26T14:02:03Z

Signed-off-by: sakumisu <1203593632@qq.com>

style: fix format

2026-09-22T10:06:49Z

Signed-off-by: sakumisu <1203593632@qq.com>

feat(core/usbd_core): add get speed api

2026-09-20T08:38:11Z

Signed-off-by: sakumisu <1203593632@qq.com>

feat(core/usbd_core): add usb3 config & desc & request

2026-09-13T14:36:34Z

Signed-off-by: sakumisu <1203593632@qq.com>

fix(core/usbh_core): fix sizeof to int

2026-09-11T03:44:41Z

Signed-off-by: sakumisu <1203593632@qq.com>

fix(security): check usbh_control_transfer return value when bmRequestType is USB_REQUEST_DIR_IN

2026-08-31T06:16:56Z

Signed-off-by: sakumisu <1203593632@qq.com>

fix(security): add check for sem&mq&thread and delete remain sources if alloc fail

2026-08-03T09:56:46Z

Signed-off-by: sakumisu <1203593632@qq.com>

fix(usbh): bounds-check cur_ep before writing ep[] in parse_config_descriptor (#426)

2026-07-17T01:43:01Z

* fix(usbh): check cur_ep against CONFIG_USBHOST_MAX_ENDPOINTS before writing ep[] parse_config_descriptor() checks cur_ep_num (the interface descriptor's self-declared bNumEndpoints) against CONFIG_USBHOST_MAX_ENDPOINTS when the INTERFACE descriptor is parsed, but cur_ep (the actual write index, incremented once per ENDPOINT sub-descriptor encountered in the byte stream) is never bounds-checked in the USB_DESCRIPTOR_TYPE_ENDPOINT case before the memcpy. A non-conformant or malicious device can declare a small bNumEndpoints while still emitting more ENDPOINT descriptors than declared in the raw config descriptor byte stream, causing cur_ep to exceed CONFIG_USBHOST_MAX_ENDPOINTS and the memcpy to write past the ep[] array, past altsetting[], and potentially past the whole usbh_configuration struct. Add the same bounds check pattern already used for cur_iface and cur_alt_setting two cases above, applied to cur_ep before the memcpy. * Allow interfaces to use configured capacity Endpoint counts are quantities, so a declaration equal to the endpoint array capacity is valid. The per-index guard still rejects descriptors that contain more endpoint records than the storage can hold. Constraint: Preserve the new cur_ep index guard Confidence: high Scope-risk: narrow Tested: Real parser matrix for declared/actual 3/3, 4/4, 5/5, and 3/5; MinGW and WSL GCC13 ASan+UBSan Not-tested: Physical USB device enumeration

fix(security): check desc len overflow

2026-07-14T02:54:43Z

Signed-off-by: sakumisu <1203593632@qq.com>