summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--class/msc/usbh_msc.c8
-rw-r--r--class/serial/usbh_serial.c16
-rw-r--r--class/vendor/display/usbd_display.c3
-rw-r--r--class/vendor/net/usbh_asix.c4
-rw-r--r--core/usbh_core.c16
5 files changed, 30 insertions, 17 deletions
diff --git a/class/msc/usbh_msc.c b/class/msc/usbh_msc.c
index 12a4f673..cec9eb0c 100644
--- a/class/msc/usbh_msc.c
+++ b/class/msc/usbh_msc.c
@@ -403,12 +403,12 @@ int usbh_msc_scsi_write10(struct usbh_msc *msc_class, uint32_t start_sector, con
memset(cbw, 0, USB_SIZEOF_MSC_CBW);
cbw->dSignature = MSC_CBW_Signature;
- cbw->dDataLength = (msc_class->blocksize * nsectors);
+ cbw->dDataLength = (msc_class->blocksize * (nsectors & 0xffff));
cbw->bCBLength = SCSICMD_WRITE10_SIZEOF;
cbw->CB[0] = SCSI_CMD_WRITE10;
SET_BE32(&cbw->CB[2], start_sector);
- SET_BE16(&cbw->CB[7], nsectors);
+ SET_BE16(&cbw->CB[7], nsectors & 0xffff);
return usbh_bulk_cbw_csw_xfer(msc_class, cbw, (struct CSW *)g_msc_cbw_csw[msc_class->sdchar - 'a'], (uint8_t *)buffer, CONFIG_USBHOST_MSC_TIMEOUT);
}
@@ -422,13 +422,13 @@ int usbh_msc_scsi_read10(struct usbh_msc *msc_class, uint32_t start_sector, cons
memset(cbw, 0, USB_SIZEOF_MSC_CBW);
cbw->dSignature = MSC_CBW_Signature;
- cbw->dDataLength = (msc_class->blocksize * nsectors);
+ cbw->dDataLength = (msc_class->blocksize * (nsectors & 0xffff));
cbw->bmFlags = 0x80;
cbw->bCBLength = SCSICMD_READ10_SIZEOF;
cbw->CB[0] = SCSI_CMD_READ10;
SET_BE32(&cbw->CB[2], start_sector);
- SET_BE16(&cbw->CB[7], nsectors);
+ SET_BE16(&cbw->CB[7], nsectors & 0xffff);
return usbh_bulk_cbw_csw_xfer(msc_class, cbw, (struct CSW *)g_msc_cbw_csw[msc_class->sdchar - 'a'], (uint8_t *)buffer, CONFIG_USBHOST_MSC_TIMEOUT);
}
diff --git a/class/serial/usbh_serial.c b/class/serial/usbh_serial.c
index 2ea09d70..66aa51fc 100644
--- a/class/serial/usbh_serial.c
+++ b/class/serial/usbh_serial.c
@@ -228,7 +228,7 @@ struct usbh_serial *usbh_serial_open(const char *devname, uint32_t open_flags)
return NULL;
}
- if (serial && serial->driver && serial->driver->open) {
+ if (serial->driver && serial->driver->open) {
ret = serial->driver->open(serial);
if (ret < 0) {
return NULL;
@@ -335,6 +335,8 @@ int usbh_serial_control(struct usbh_serial *serial, int cmd, void *arg)
struct usbh_serial_termios *termios = (struct usbh_serial_termios *)arg;
struct cdc_line_coding line_coding;
+ USB_ASSERT(termios != NULL);
+
line_coding.dwDTERate = termios->baudrate;
line_coding.bCharFormat = termios->stopbits;
line_coding.bParityType = termios->parity;
@@ -347,7 +349,7 @@ int usbh_serial_control(struct usbh_serial *serial, int cmd, void *arg)
usbh_kill_urb(&serial->bulkout_urb);
}
- if (serial && serial->driver && serial->driver->set_line_coding) {
+ if (serial->driver && serial->driver->set_line_coding) {
ret = serial->driver->set_line_coding(serial, &line_coding);
if (ret < 0) {
return ret;
@@ -358,7 +360,7 @@ int usbh_serial_control(struct usbh_serial *serial, int cmd, void *arg)
memcpy(&serial->line_coding, &line_coding, sizeof(struct cdc_line_coding));
- if (serial && serial->driver && serial->driver->set_flow_control) {
+ if (serial->driver && serial->driver->set_flow_control) {
ret = serial->driver->set_flow_control(serial, termios->rtscts);
}
@@ -383,8 +385,10 @@ int usbh_serial_control(struct usbh_serial *serial, int cmd, void *arg)
struct usbh_serial_termios *termios = (struct usbh_serial_termios *)arg;
struct cdc_line_coding line_coding;
- if (serial && serial->driver && serial->driver->get_line_coding) {
- return serial->driver->get_line_coding(serial, &line_coding);
+ USB_ASSERT(termios != NULL);
+
+ if (serial->driver && serial->driver->get_line_coding) {
+ serial->driver->get_line_coding(serial, &line_coding);
} else {
memcpy(&line_coding, &serial->line_coding, sizeof(struct cdc_line_coding));
}
@@ -424,7 +428,7 @@ int usbh_serial_control(struct usbh_serial *serial, int cmd, void *arg)
uint32_t *flags = (uint32_t *)arg;
int status;
- if (serial && serial->driver && serial->driver->get_modem_status) {
+ if (serial->driver && serial->driver->get_modem_status) {
status = serial->driver->get_modem_status(serial);
if (status < 0) {
return status;
diff --git a/class/vendor/display/usbd_display.c b/class/vendor/display/usbd_display.c
index 181da6e5..b9dfd7af 100644
--- a/class/vendor/display/usbd_display.c
+++ b/class/vendor/display/usbd_display.c
@@ -127,6 +127,7 @@ drop_frame:
usbd_ep_start_read(busid, g_usbd_display.out_ep.ep_addr, usb_dispay_dummy, usbd_get_ep_mps(0, g_usbd_display.out_ep.ep_addr));
return;
get_frame:
+ USB_ASSERT((usb_display_buf_offset + 16384) <= g_usbd_display.current_frame->frame_bufsize);
usbd_ep_start_read(busid, g_usbd_display.out_ep.ep_addr, &g_usbd_display.current_frame->frame_buf[usb_display_buf_offset], 16384);
return;
}
@@ -154,7 +155,7 @@ struct usbd_interface *usbd_display_init_intf(struct usbd_interface *intf,
usbd_add_endpoint(0, &g_usbd_display.in_ep);
for (uint32_t i = 0; i < count; i++) {
- USB_ASSERT_MSG(frame[i].frame_bufsize % 16384, "frame_bufsize must be the multiple of 16384");
+ USB_ASSERT_MSG((frame[i].frame_bufsize % 16384) == 0, "frame_bufsize must be the multiple of 16384");
}
usbd_display_frame_create(frame, count);
diff --git a/class/vendor/net/usbh_asix.c b/class/vendor/net/usbh_asix.c
index ffa1ed50..06a0d0ba 100644
--- a/class/vendor/net/usbh_asix.c
+++ b/class/vendor/net/usbh_asix.c
@@ -15,8 +15,8 @@
static struct usbh_asix g_asix_class;
-static USB_NOCACHE_RAM_SECTION USB_MEM_ALIGNX uint8_t g_asix_rx_buffer[USB_ALIGN_UP(CONFIG_USBHOST_ASIX_ETH_MAX_TX_SIZE, CONFIG_USB_ALIGN_SIZE)];
-static USB_NOCACHE_RAM_SECTION USB_MEM_ALIGNX uint8_t g_asix_tx_buffer[USB_ALIGN_UP(CONFIG_USBHOST_ASIX_ETH_MAX_RX_SIZE, CONFIG_USB_ALIGN_SIZE)];
+static USB_NOCACHE_RAM_SECTION USB_MEM_ALIGNX uint8_t g_asix_rx_buffer[USB_ALIGN_UP(CONFIG_USBHOST_ASIX_ETH_MAX_RX_SIZE, CONFIG_USB_ALIGN_SIZE)];
+static USB_NOCACHE_RAM_SECTION USB_MEM_ALIGNX uint8_t g_asix_tx_buffer[USB_ALIGN_UP(CONFIG_USBHOST_ASIX_ETH_MAX_TX_SIZE, CONFIG_USB_ALIGN_SIZE)];
static USB_NOCACHE_RAM_SECTION USB_MEM_ALIGNX uint8_t g_asix_inttx_buffer[USB_ALIGN_UP(16, CONFIG_USB_ALIGN_SIZE)];
static USB_NOCACHE_RAM_SECTION USB_MEM_ALIGNX uint8_t g_asix_buf[USB_ALIGN_UP(32, CONFIG_USB_ALIGN_SIZE)];
diff --git a/core/usbh_core.c b/core/usbh_core.c
index cce9a46e..5828a498 100644
--- a/core/usbh_core.c
+++ b/core/usbh_core.c
@@ -225,7 +225,7 @@ static int parse_config_descriptor(struct usbh_hubport *hport, struct usb_config
memset(hport->config.intf, 0, sizeof(struct usbh_interface) * CONFIG_USBHOST_MAX_INTERFACES);
- while (p[DESC_bLength] && (desc_len <= length)) {
+ while (p[DESC_bLength]) {
switch (p[DESC_bDescriptorType]) {
case USB_DESCRIPTOR_TYPE_INTERFACE:
intf_desc = (struct usb_interface_descriptor *)p;
@@ -276,6 +276,10 @@ static int parse_config_descriptor(struct usbh_hubport *hport, struct usb_config
/* skip to next descriptor */
desc_len += p[DESC_bLength];
p += p[DESC_bLength];
+
+ if(desc_len > length) {
+ return -USB_ERR_NOMEM;
+ }
}
}
return 0;
@@ -799,6 +803,10 @@ static struct usbh_hubport *usbh_list_all_hubport(struct usbh_hub *hub, uint8_t
struct usbh_hubport *hport;
struct usbh_hub *hub_next;
+ if ((hub_index > hub->index) || (hub_port > hub->nports)) {
+ return NULL;
+ }
+
if (hub->index == hub_index) {
hport = &hub->child[hub_port - 1];
if (hport->connected) {
@@ -816,9 +824,9 @@ static struct usbh_hubport *usbh_list_all_hubport(struct usbh_hub *hub, uint8_t
hub_next = hport->config.intf[itf].priv;
if (hub_next && hub_next->connected) {
- hport = usbh_list_all_hubport(hub_next, hub_index, hub_port);
- if (hport) {
- return hport;
+ struct usbh_hubport *hport_next = usbh_list_all_hubport(hub_next, hub_index, hub_port);
+ if (hport_next) {
+ return hport_next;
}
}
}
generated by cgit v1.3.1 (git 2.54.0) at 2026-08-13 03:19:46 +0000