fix(security): check msc block sizeHEADmaster

Signed-off-by: sakumisu <[email protected]>

2 files changed, 13 insertions, 5 deletions

diff --git a/class/msc/usbh_msc.c b/class/msc/usbh_msc.c
index 35db3447..1a93af6a 100644
--- a/class/msc/usbh_msc.c
+++ b/class/msc/usbh_msc.c
@@ -389,11 +389,14 @@ int usbh_msc_scsi_init(struct usbh_msc *msc_class)
         return ret;
     }
 
-    if (msc_class->blocksize > 0) {
+    if (msc_class->blocksize == 512 ||
+        msc_class->blocksize == 1024 ||
+        msc_class->blocksize == 2048 ||
+        msc_class->blocksize == 4096) {
         USB_LOG_INFO("Capacity info:\r\n");
         USB_LOG_INFO("Block num:%d,block size:%d\r\n", (unsigned int)msc_class->blocknum, (unsigned int)msc_class->blocksize);
     } else {
-        USB_LOG_ERR("Invalid block size\r\n");
+        USB_LOG_ERR("Invalid block size %u\r\n", (unsigned int)msc_class->blocksize);
         return -USB_ERR_RANGE;
     }
 
diff --git a/platform/fatfs/usbh_fatfs.c b/platform/fatfs/usbh_fatfs.c
index abb7181b..9c799d62 100644
--- a/platform/fatfs/usbh_fatfs.c
+++ b/platform/fatfs/usbh_fatfs.c
@@ -14,12 +14,17 @@ int USB_disk_initialize(void)
 {
     active_msc_class = (struct usbh_msc *)usbh_find_class_instance("/dev/sda");
     if (active_msc_class == NULL) {
-        printf("do not find /dev/sda\r\n");
+        USB_LOG_ERR("do not find /dev/sda\r\n");
         return RES_NOTRDY;
     }
     if (usbh_msc_scsi_init(active_msc_class) < 0) {
         return RES_NOTRDY;
     }
+
+    if ((active_msc_class->blocksize < FF_MIN_SS) || (active_msc_class->blocksize > FF_MAX_SS)) {
+        USB_LOG_ERR("unsupported block size %u\r\n", (unsigned int)active_msc_class->blocksize);
+        return RES_NOTRDY;
+    }
     return RES_OK;
 }
 
@@ -38,7 +43,7 @@ int USB_disk_read(BYTE *buff, LBA_t sector, UINT count)
     if ((uint32_t)buff & (CONFIG_USB_ALIGN_SIZE - 1)) {
         align_buf = (uint8_t *)aligned_alloc(CONFIG_USB_ALIGN_SIZE, count * active_msc_class->blocksize);
         if (!align_buf) {
-            printf("msc get align buf failed\r\n");
+            USB_LOG_ERR("msc get align buf failed\r\n");
             return -USB_ERR_NOMEM;
         }
     }
@@ -68,7 +73,7 @@ int USB_disk_write(const BYTE *buff, LBA_t sector, UINT count)
     if ((uint32_t)buff & (CONFIG_USB_ALIGN_SIZE - 1)) {
         align_buf = (uint8_t *)aligned_alloc(CONFIG_USB_ALIGN_SIZE, count * active_msc_class->blocksize);
         if (!align_buf) {
-            printf("msc get align buf failed\r\n");
+            USB_LOG_ERR("msc get align buf failed\r\n");
             return -USB_ERR_NOMEM;
         }
         usb_memcpy(align_buf, buff, count * active_msc_class->blocksize);