From 9ddfd6017c0a328a8d18b048eb9048f92d0b0e14 Mon Sep 17 00:00:00 2001
From: sakumisu <1203593632@qq.com>
Date: Sat, 24 Sep 2022 17:26:17 +0800
Subject: check if video frame header is illegal

---
 class/video/usbh_video.c | 25 ++++++++++++++++---------
 1 file changed, 16 insertions(+), 9 deletions(-)

diff --git a/class/video/usbh_video.c b/class/video/usbh_video.c
index 5c404a6d..7e00cbc2 100644
--- a/class/video/usbh_video.c
+++ b/class/video/usbh_video.c
@@ -444,16 +444,19 @@ void usbh_videostreaming_parse_mjpeg(struct usbh_urb *urb, struct usbh_videostre
             uint8_t errorBit             : 1U;
             uint8_t endOfHeader          : 1U;
         */
-
+        if (iso_packet[i].actual_length == 0) { /* skip */
+            stream->bufoffset = 0;
+            continue;
+        }
         if (iso_packet[i].actual_length < iso_packet[i].transfer_buffer[0]) {
-            return;
+            stream->bufoffset = 0;
+            continue;
         }
-        if (iso_packet[i].transfer_buffer[1] & (1 << 6)) {
+        if ((iso_packet[i].transfer_buffer[0] > 12) || (iso_packet[i].transfer_buffer[0] == 0)) {
             stream->bufoffset = 0;
             continue;
         }
-
-        if (iso_packet[i].actual_length == 0) { /* skip */
+        if (iso_packet[i].transfer_buffer[1] & (1 << 6)) {
             stream->bufoffset = 0;
             continue;
         }
@@ -510,15 +513,19 @@ void usbh_videostreaming_parse_yuyv2rgb565(struct usbh_urb *urb, struct usbh_vid
             uint8_t endOfHeader          : 1U;
         */
 
+        if (iso_packet[i].actual_length == 0) { /* skip */
+            stream->bufoffset = 0;
+            continue;
+        }
         if (iso_packet[i].actual_length < iso_packet[i].transfer_buffer[0]) {
-            return;
+            stream->bufoffset = 0;
+            continue;
         }
-        if (iso_packet[i].transfer_buffer[1] & (1 << 6)) {
+        if ((iso_packet[i].transfer_buffer[0] > 12) || (iso_packet[i].transfer_buffer[0] == 0)) {
             stream->bufoffset = 0;
             continue;
         }
-
-        if (iso_packet[i].actual_length == 0) { /* skip */
+        if (iso_packet[i].transfer_buffer[1] & (1 << 6)) {
             stream->bufoffset = 0;
             continue;
         }
-- 
cgit v1.3.1