summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-07-17fix(usbh): bounds-check cur_ep before writing ep[] in ↵HEADmasteryi chen
parse_config_descriptor (#426) * fix(usbh): check cur_ep against CONFIG_USBHOST_MAX_ENDPOINTS before writing ep[] parse_config_descriptor() checks cur_ep_num (the interface descriptor's self-declared bNumEndpoints) against CONFIG_USBHOST_MAX_ENDPOINTS when the INTERFACE descriptor is parsed, but cur_ep (the actual write index, incremented once per ENDPOINT sub-descriptor encountered in the byte stream) is never bounds-checked in the USB_DESCRIPTOR_TYPE_ENDPOINT case before the memcpy. A non-conformant or malicious device can declare a small bNumEndpoints while still emitting more ENDPOINT descriptors than declared in the raw config descriptor byte stream, causing cur_ep to exceed CONFIG_USBHOST_MAX_ENDPOINTS and the memcpy to write past the ep[] array, past altsetting[], and potentially past the whole usbh_configuration struct. Add the same bounds check pattern already used for cur_iface and cur_alt_setting two cases above, applied to cur_ep before the memcpy. * Allow interfaces to use configured capacity Endpoint counts are quantities, so a declaration equal to the endpoint array capacity is valid. The per-index guard still rejects descriptors that contain more endpoint records than the storage can hold. Constraint: Preserve the new cur_ep index guard Confidence: high Scope-risk: narrow Tested: Real parser matrix for declared/actual 3/3, 4/4, 5/5, and 3/5; MinGW and WSL GCC13 ASan+UBSan Not-tested: Physical USB device enumeration
2026-07-15update(gamepad): update xinput report and descsakumisu
Signed-off-by: sakumisu <[email protected]>
2026-07-14fix(security): check desc len overflowsakumisu
Signed-off-by: sakumisu <[email protected]>
2026-07-12update(chore): add clang-tidysakumisu
Signed-off-by: sakumisu <[email protected]>
2026-07-12update(security): check null pointer and overflowsakumisu
Signed-off-by: sakumisu <[email protected]>
2026-07-12update(osal): remove logsakumisu
Signed-off-by: sakumisu <[email protected]>
2026-07-02update(tools): update usb speed testsakumisu
Signed-off-by: sakumisu <[email protected]>
2026-06-30feat(platform): add zmk supportsakumisu
Signed-off-by: sakumisu <[email protected]>
2026-06-30update(tool): update test_cdc_speed.py with argssakumisu
Signed-off-by: sakumisu <[email protected]>
2026-06-30fix(ci): fix ci buildsakumisu
Signed-off-by: sakumisu <[email protected]>
2026-06-30update(port/musb/usb_glue_sifli): add zephyr supportsakumisu
Signed-off-by: sakumisu <[email protected]>
2026-06-30fix(port/chipidea): using sutw semaphore by isr handler for setupsakumisu
Signed-off-by: sakumisu <[email protected]>
2026-06-30fix: fix warningssakumisu
Signed-off-by: sakumisu <[email protected]>
2026-06-30update(port/dwc2): add limit for transfer sizesakumisu
Signed-off-by: sakumisu <[email protected]>
2026-06-26usb_hc.h中bug修改和usb_glue_nation.c中添加N32H49X和N32H7XX系列MCU� ↵Onlyou_tzZ
��USBHS支持 (#422) * 1、usb_hc.h中struct usbh_urb结构体添加defined(__CC_ARM)判断，MDK AC5编译器不支持struct usbh_iso_frame_packet iso_packet[0]只支持struct usbh_iso_frame_packet *iso_packet 2、usb_glue_nation.c中添加N32H49X和N32H7XX系列MCU的USBHS支持 * 回退对usb_hc.h的修改
2026-06-16update(class/video): change frame interval config to only onesakumisu
Signed-off-by: sakumisu <[email protected]>
2026-06-16docs: update supportsakumisu
Signed-off-by: sakumisu <[email protected]>
2026-06-15chore: add mtp pathsakumisu
Signed-off-by: sakumisu <[email protected]>
2026-06-15fix(demo): fix uac2 feedback sizesakumisu
Signed-off-by: sakumisu <[email protected]>
2026-06-04update(class/serial): add err log when rx overflowsakumisu
Signed-off-by: sakumisu <[email protected]>
2026-06-01refactor(class/mtp): remove system stat and fcntl dependencesakumisu
Signed-off-by: sakumisu <[email protected]>
2026-06-01refactor(audio): refactor audio host apisakumisu
Signed-off-by: sakumisu <[email protected]>
2026-05-27fix(demo): change const to macrosakumisu
Signed-off-by: sakumisu <[email protected]>
2026-05-27update(ci): enable all class api to test usagesakumisu
Signed-off-by: sakumisu <[email protected]>
2026-05-27fix(common/usb_def): fix msos descsakumisu
Signed-off-by: sakumisu <[email protected]>
2026-05-26docs: update rascsakumisu
Signed-off-by: sakumisu <[email protected]>
2026-05-26docs: update demosakumisu
Signed-off-by: sakumisu <[email protected]>
2026-05-22fix(port/musb/usb_glue_sifli): fix phy and reset configsakumisu
Signed-off-by: sakumisu <[email protected]>
2026-05-22update(ci): update mic pool sizesakumisu
Signed-off-by: sakumisu <[email protected]>
2026-05-21fix(class/dfu): fix read data without constsakumisu
Signed-off-by: sakumisu <[email protected]>
2026-05-21fix(class/rndis/usbd_rndis): add dummy byte for tx not zlp when txlen is a ↵sakumisu
multiply of mps Signed-off-by: sakumisu <[email protected]>
2026-05-19docs: fix missing imagesakumisu
Signed-off-by: sakumisu <[email protected]>
2026-05-19fix(platform/rtthread): implement rx_complete_callback for rtt ↵sakumisu
device->rx_indicate Signed-off-by: sakumisu <[email protected]>
2026-05-19fix(class/hid/usbh_hid): fix missing hport->intfsakumisu
Signed-off-by: sakumisu <[email protected]>
2026-05-13update(ci): update lwipoptssakumisu
Signed-off-by: sakumisu <[email protected]>
2026-05-12Add HS support for esp32s31yanke
2026-05-08feat(port/renesas): support renesas devicesakumisu
Signed-off-by: sakumisu <[email protected]>
2026-04-28docs: release v1.6.1v1.6.1release/v1.6sakumisu
Signed-off-by: sakumisu <[email protected]>
2026-04-23fix(class/dfu): only reset device when dfu-util with -e or leave cmdsakumisu
Signed-off-by: sakumisu <[email protected]>
2026-04-23update(core/usbh_otg): update usbh_initialize paramsakumisu
Signed-off-by: sakumisu <[email protected]>
2026-04-23fix(class/hub): clear mq &sem at deinitsakumisu
Signed-off-by: sakumisu <[email protected]>
2026-04-23update(ci): update lwipoptssakumisu
Signed-off-by: sakumisu <[email protected]>
2026-04-21fix(class/msc/usbd_msc): fix inquiry80 sizesakumisu
Signed-off-by: sakumisu <[email protected]>
2026-04-21fix(security): remove hport mutex safelysakumisu
Signed-off-by: sakumisu <[email protected]>
2026-04-21fix(third_party/bluetooth): fix bugs in USB host BT HCI driversalvin
NimBLE (nimble-1.6.0/ble_hci_usbh.c): - fix hci_read_callback: pass full buffer to hci_h4_sm_rx in one call instead of splitting type byte and payload into two calls - fix ble_transport_to_ll_cmd_impl: use struct ble_hci_cmd for type-safe length calculation instead of raw byte indexing - fix ble_transport_to_ll_acl_impl: gather mbuf with os_mbuf_copydata and issue single usbh_bluetooth_hci_write; the old per-segment loop violated USB Bluetooth class bulk transfer requirements - fix unused-parameter warnings in run/stop callbacks Zephyr (zephyr_bluetooth-2.7.5/ble_hci_usbh.c): - remove unreachable fallthrough comment after return statement - restore ISO payload length check (was commented out); use inline mask (& 0x3FFF) per BT Core Spec v5.x Vol 4 Part E Section 5.4.5 - fix bt_usbh_send error code: 255 -> -EIO - guard bt_hci_driver_register with static bool to prevent duplicate registration on USB reconnect - fix unused-parameter warnings in run/stop callbacks
2026-04-17fix(class/hub): remove bus mutex, replace with mq to exit threadsakumisu
Signed-off-by: sakumisu <[email protected]>
2026-04-16fix(class): break quickly with gotosakumisu
Signed-off-by: sakumisu <[email protected]>
2026-04-16fix(port/hpm): add sdk version checksakumisu
Signed-off-by: sakumisu <[email protected]>
2026-04-13[update] port: hpmicro: dcd: using sutw semaphore by isr handler for setupZhihong Chen
Signed-off-by: Zhihong Chen <[email protected]>
2026-04-07fix(class/cdc): add altsetting 1 for ecm/ncmsakumisu
Signed-off-by: sakumisu <[email protected]>
generated by cgit v1.3.1 (git 2.54.0) at 2026-08-13 10:57:14 +0000