diff options
Diffstat (limited to 'class/vendor/net')
| -rw-r--r-- | class/vendor/net/usbh_asix.c | 24 | ||||
| -rw-r--r-- | class/vendor/net/usbh_rtl8152.c | 19 |
2 files changed, 33 insertions, 10 deletions
diff --git a/class/vendor/net/usbh_asix.c b/class/vendor/net/usbh_asix.c index e63b274b..4e711f3a 100644 --- a/class/vendor/net/usbh_asix.c +++ b/class/vendor/net/usbh_asix.c @@ -718,10 +718,13 @@ void usbh_asix_rx_thread(CONFIG_USB_OSAL_THREAD_SET_ARGV) data_offset = 0; while (g_asix_rx_length > 0) { + if (g_asix_rx_length < 4) { + break; + } len = ((uint16_t)g_asix_rx_buffer[data_offset + 0] | ((uint16_t)(g_asix_rx_buffer[data_offset + 1]) << 8)) & 0x7ff; len_crc = g_asix_rx_buffer[data_offset + 2] | ((uint16_t)(g_asix_rx_buffer[data_offset + 3]) << 8); - if (len != (~len_crc & 0x7ff)) { + if (len != (~len_crc & 0x7ff) || len == 0 || (len > g_asix_rx_length - 4)) { USB_LOG_ERR("rx header error\r\n"); g_asix_rx_length = 0; continue; @@ -732,8 +735,9 @@ void usbh_asix_rx_thread(CONFIG_USB_OSAL_THREAD_SET_ARGV) g_asix_rx_length -= (len + 4); data_offset += (len + 4); - if (g_asix_rx_length < 4) { - g_asix_rx_length = 0; + if ((len & 1) && g_asix_rx_length > 0) { + g_asix_rx_length--; + data_offset++; } } } else { @@ -760,17 +764,21 @@ int usbh_asix_eth_output(uint32_t buflen) return -USB_ERR_NOTCONN; } + if ((buflen + 8) > sizeof(g_asix_tx_buffer)) { + return -USB_ERR_NOMEM; + } + g_asix_tx_buffer[0] = buflen & 0xff; g_asix_tx_buffer[1] = (buflen >> 8) & 0xff; g_asix_tx_buffer[2] = ~g_asix_tx_buffer[0]; g_asix_tx_buffer[3] = ~g_asix_tx_buffer[1]; - if (!(buflen + 4) % USB_GET_MAXPACKETSIZE(g_asix_class.bulkout->wMaxPacketSize)) { + if (((buflen + 4U) % USB_GET_MAXPACKETSIZE(g_asix_class.bulkout->wMaxPacketSize)) == 0U) { USB_LOG_DBG("txlen:%d\r\n", buflen + 8); - g_asix_tx_buffer[buflen + 4 + 0] = 0x00; - g_asix_tx_buffer[buflen + 4 + 1] = 0x00; - g_asix_tx_buffer[buflen + 4 + 2] = 0xff; - g_asix_tx_buffer[buflen + 4 + 3] = 0xff; + g_asix_tx_buffer[buflen + 4] = 0x00; + g_asix_tx_buffer[buflen + 5] = 0x00; + g_asix_tx_buffer[buflen + 6] = 0xff; + g_asix_tx_buffer[buflen + 7] = 0xff; actual_len = buflen + 8; } else { USB_LOG_DBG("txlen:%d\r\n", buflen + 4); diff --git a/class/vendor/net/usbh_rtl8152.c b/class/vendor/net/usbh_rtl8152.c index 16393ab1..079d4e2f 100644 --- a/class/vendor/net/usbh_rtl8152.c +++ b/class/vendor/net/usbh_rtl8152.c @@ -2186,9 +2186,16 @@ void usbh_rtl8152_rx_thread(CONFIG_USB_OSAL_THREAD_SET_ARGV) USB_LOG_DBG("rxlen:%d\r\n", g_rtl8152_rx_length); while (g_rtl8152_rx_length > 0) { + if (g_rtl8152_rx_length < sizeof(struct rx_desc)) { + break; + } struct rx_desc *rx_desc = (struct rx_desc *)&g_rtl8152_rx_buffer[data_offset]; len = rx_desc->opts1 & RX_LEN_MASK; + if (len == 0 || len > g_rtl8152_rx_length - sizeof(struct rx_desc)) { + USB_LOG_ERR("invalid rtl8152 rx length\r\n"); + break; + } USB_LOG_DBG("data_offset:%d, eth len:%d\r\n", data_offset, len); @@ -2199,8 +2206,12 @@ void usbh_rtl8152_rx_thread(CONFIG_USB_OSAL_THREAD_SET_ARGV) g_rtl8152_rx_length -= (len + sizeof(struct rx_desc)); if (len & (RX_ALIGN - 1)) { - data_offset += (RX_ALIGN - (len & (RX_ALIGN - 1))); - g_rtl8152_rx_length -= (RX_ALIGN - (len & (RX_ALIGN - 1))); + uint32_t padding = RX_ALIGN - (len & (RX_ALIGN - 1)); + if (padding > g_rtl8152_rx_length) { + break; + } + data_offset += padding; + g_rtl8152_rx_length -= padding; } } } else { @@ -2227,6 +2238,10 @@ int usbh_rtl8152_eth_output(uint32_t buflen) return -USB_ERR_NOTCONN; } + if ((buflen + sizeof(struct tx_desc)) > sizeof(g_rtl8152_tx_buffer)) { + return -USB_ERR_NOMEM; + } + tx_desc = (struct tx_desc *)g_rtl8152_tx_buffer; tx_desc->opts1 = buflen | TX_FS | TX_LS; tx_desc->opts2 = 0; |