examples/mtp: clamp SendObject writes to the declared object size

2026-08-17T05:11:53Z

fs_send_object() copied every received payload to f->data using only the running offset, so a host sending more data than its SendObjectInfo declared wrote past the object and overflowed fs_buf. Clamp each copy to what remains of f->size.

class/mtp: correct data phase completion and transaction recovery

2026-08-17T05:11:53Z

The data-out phase ended before its terminating ZLP and before the application had seen the final payload, and several transaction states had no way back to idle. Reworked as one state machine: - Add MTP_PHASE_DATA_COMPLETE, entered once the data phase has fully finished - for an exact buffer-multiple data-out, only after the host's terminating ZLP - and deliver tud_mtp_data_complete_cb() from there. tud_mtp_response_send() now refuses while the phase is still MTP_PHASE_DATA: ep_out still owes the host a read at that point and re-arming it for a new command would race that read. - Arm the terminating-ZLP read before handing the final payload to the application, as the IN path already does. The 0-length read passes a NULL buffer so the payload is untouched, and claiming ep_out first means a late tud_mtp_data_receive() fails its own claim instead of breaking the driver's next step. - Honor the documented negative return of tud_mtp_data_xfer_cb() and tud_mtp_data_complete_cb() by entering MTP_PHASE_ERROR, which stalls both endpoints. This is the application's way out of a data phase now that a response cannot be sent from one. Their weak stubs return 0 so an application that does not implement them is unaffected. - Take total_len from the container header the host sends on the first OUT packet. The application can only set it up front when it knows the size (SendObject); SendObjectInfo cannot, so total_len kept the 12-byte header default and the phase ended on the first packet. - Reject a runt or misdirected container in both the command and data phases: a short packet was matched against stale buffer contents, and the failed TU_VERIFY left ep_out neither armed nor stalled. The first data-out packet previously underflowed payload_bytes instead. - Restore the previous phase when tud_mtp_data_send()/_receive() cannot claim their endpoint, so the application's fallback response is not refused by a phase the driver never actually entered. - Re-arm ep_out after MTP_REQ_CANCEL of a data phase, and defer the new-command read when ep_out is still busy with the ZLP read of an abandoned transaction: usbd_edpt_xfer() asserts on a busy endpoint, so MTP_REQ_RESET could not recover. The MTP example follows the same contract: a handler error raised mid data phase (fs_send_object_info validates the received ObjectInfo, so STORE_FULL and INVALID_PARENT_OBJECT can only be raised there) is kept and answered from tud_mtp_data_complete_cb() once the phase completes.

Add GetPartialObject to MTP example

2026-05-13T20:27:57Z

Added support for GetPartialObject for better compatibility with Linux file explorers.

mtp: add sending mtp response if MTP_RESP_OPERATION_NOT_SUPPORTED

2026-03-25T08:43:48Z

example/mtp: fix root parent id

2025-12-29T19:54:04Z

Signed-off-by: HiFiPhile

fix more alerts found by pvs-studio

2025-11-07T16:50:16Z

added .clang-format

2025-11-05T10:34:27Z

fix more alerts disable IAR CStat since pvs-studio check is better integrated with clion

fix iar build

2025-10-03T04:26:14Z

fix mtp serial

2025-10-02T05:49:38Z

tinyusb.git/examples/device/mtp/src/mtp_fs_example.c, branch claude/mtp-data-phase-fixes