diff options
Diffstat (limited to 'class/wireless')
| -rw-r--r-- | class/wireless/usbd_rndis.c | 13 | ||||
| -rw-r--r-- | class/wireless/usbh_rndis.c | 10 |
2 files changed, 21 insertions, 2 deletions
diff --git a/class/wireless/usbd_rndis.c b/class/wireless/usbd_rndis.c index ea62c50e..08366250 100644 --- a/class/wireless/usbd_rndis.c +++ b/class/wireless/usbd_rndis.c @@ -477,8 +477,18 @@ void rndis_bulk_out(uint8_t busid, uint8_t ep, uint32_t nbytes) (void)busid; (void)ep; + if (nbytes < sizeof(rndis_data_packet_t)) { + usbd_rndis_start_read((uint8_t *)g_rndis_rx_data_buffer, g_rndis_rx_total_length); + return; + } + hdr = (rndis_data_packet_t *)g_rndis_rx_data_buffer; - if ((hdr->MessageType != REMOTE_NDIS_PACKET_MSG) || (nbytes < hdr->MessageLength)) { + if ((hdr->MessageType != REMOTE_NDIS_PACKET_MSG) || + (hdr->MessageLength < sizeof(rndis_data_packet_t)) || + (hdr->MessageLength > nbytes) || + (hdr->DataOffset < sizeof(rndis_data_packet_t) - sizeof(rndis_generic_msg_t)) || + (hdr->DataOffset > hdr->MessageLength - sizeof(rndis_generic_msg_t)) || + (hdr->DataLength > hdr->MessageLength - sizeof(rndis_generic_msg_t) - hdr->DataOffset)) { usbd_rndis_start_read((uint8_t *)g_rndis_rx_data_buffer, g_rndis_rx_total_length); return; } @@ -555,6 +565,7 @@ struct pbuf *usbd_rndis_eth_rx(void) usbd_rndis_start_read(g_rndis_rx_buffer, sizeof(g_rndis_rx_buffer)); return NULL; } + usb_memcpy(p->payload, (uint8_t *)g_rndis_rx_data_buffer, g_rndis_rx_data_length); p->len = g_rndis_rx_data_length; diff --git a/class/wireless/usbh_rndis.c b/class/wireless/usbh_rndis.c index 22f0e369..d6354d5a 100644 --- a/class/wireless/usbh_rndis.c +++ b/class/wireless/usbh_rndis.c @@ -544,6 +544,9 @@ void usbh_rndis_rx_thread(CONFIG_USB_OSAL_THREAD_SET_ARGV) while (g_rndis_rx_length > 0) { USB_LOG_DBG("rxlen:%u\r\n", (unsigned int)g_rndis_rx_length); + if (g_rndis_rx_length < sizeof(rndis_data_packet_t)) { + break; + } pmsg = (rndis_data_packet_t *)(g_rndis_rx_buffer + pmg_offset); /* Not word-aligned case */ @@ -552,7 +555,12 @@ void usbh_rndis_rx_thread(CONFIG_USB_OSAL_THREAD_SET_ARGV) pmsg = &temp; } - if (pmsg->MessageType == REMOTE_NDIS_PACKET_MSG) { + if (pmsg->MessageType == REMOTE_NDIS_PACKET_MSG && + pmsg->MessageLength >= sizeof(rndis_data_packet_t) && + pmsg->MessageLength <= g_rndis_rx_length && + pmsg->DataOffset >= sizeof(rndis_data_packet_t) - sizeof(rndis_generic_msg_t) && + pmsg->DataOffset <= pmsg->MessageLength - sizeof(rndis_generic_msg_t) && + pmsg->DataLength <= pmsg->MessageLength - sizeof(rndis_generic_msg_t) - pmsg->DataOffset) { uint8_t *buf = (uint8_t *)(g_rndis_rx_buffer + pmg_offset + sizeof(rndis_generic_msg_t) + pmsg->DataOffset); usbh_rndis_eth_input(buf, pmsg->DataLength); |