fix(security): check array overflowdev

Signed-off-by: sakumisu <[email protected]>

3 files changed, 22 insertions, 5 deletions

diff --git a/class/serial/usbh_cp210x.c b/class/serial/usbh_cp210x.c
index 0f645a17..d3217aa2 100644
--- a/class/serial/usbh_cp210x.c
+++ b/class/serial/usbh_cp210x.c
@@ -328,8 +328,8 @@ errout:
 static void usbh_cp210x_detach(struct usbh_serial *serial)
 {
     if (serial && serial->priv) {
-        serial->priv = NULL;
         usb_osal_free(serial->priv);
+        serial->priv = NULL;
     }
 }
 
diff --git a/class/serial/usbh_ftdi.c b/class/serial/usbh_ftdi.c
index 19f00110..5ed9191f 100644
--- a/class/serial/usbh_ftdi.c
+++ b/class/serial/usbh_ftdi.c
@@ -268,8 +268,8 @@ errout:
 static void usbh_ftdi_detach(struct usbh_serial *serial)
 {
     if (serial && serial->priv) {
-        serial->priv = NULL;
         usb_osal_free(serial->priv);
+        serial->priv = NULL;
     }
 }
 
diff --git a/class/serial/usbh_serial.c b/class/serial/usbh_serial.c
index 65bf63f6..5e79cc0c 100644
--- a/class/serial/usbh_serial.c
+++ b/class/serial/usbh_serial.c
@@ -192,6 +192,9 @@ struct usbh_serial *usbh_serial_probe(struct usbh_hubport *hport, uint8_t intf,
 
     if (!serial->bulkin || !serial->bulkout) {
         USB_LOG_ERR("Serial bulk in/out endpoint not found\r\n");
+        if (driver->detach) {
+            driver->detach(serial);
+        }
         usbh_serial_free(serial);
         return NULL;
     }
@@ -352,7 +355,13 @@ int usbh_serial_control(struct usbh_serial *serial, int cmd, void *arg)
             struct usbh_serial_termios *termios = (struct usbh_serial_termios *)arg;
             struct cdc_line_coding line_coding;
 
-            USB_ASSERT(termios != NULL);
+            if (termios == NULL) {
+                return -USB_ERR_INVAL;
+            }
+
+            if (termios->baudrate == 0) {
+                return -USB_ERR_INVAL;
+            }
 
             line_coding.dwDTERate = termios->baudrate;
             line_coding.bCharFormat = termios->stopbits;
@@ -399,10 +408,18 @@ int usbh_serial_control(struct usbh_serial *serial, int cmd, void *arg)
             struct usbh_serial_termios *termios = (struct usbh_serial_termios *)arg;
             struct cdc_line_coding line_coding;
 
-            USB_ASSERT(termios != NULL);
+            if (termios == NULL) {
+                return -USB_ERR_INVAL;
+            }
 
             if (serial->driver && serial->driver->get_line_coding) {
-                serial->driver->get_line_coding(serial, &line_coding);
+                ret = serial->driver->get_line_coding(serial, &line_coding);
+                if (ret < 0) {
+                    return ret;
+                }
+                if (ret != (int)sizeof(struct cdc_line_coding)) {
+                    return -USB_ERR_INVAL;
+                }
             } else {
                 memcpy(&line_coding, &serial->line_coding, sizeof(struct cdc_line_coding));
             }