diff options
| author | MasterPhi <[email protected]> | 2021-06-15 21:16:51 +0200 |
|---|---|---|
| committer | MasterPhi <[email protected]> | 2021-06-15 21:16:51 +0200 |
| commit | 6cc702e9ece9bbf32ac9ad4283407b4937c671a9 (patch) | |
| tree | 3ecd16bf0cd11ffaf3f2e554b659fe3c58b85553 | |
| parent | 54dc694be4430e51d153405afa3b80d949479558 (diff) | |
Prevent buffer overflow.
Signed-off-by: MasterPhi <[email protected]>
| -rw-r--r-- | src/portable/microchip/samx7x/dcd_samx7x.c | 16 |
1 files changed, 13 insertions, 3 deletions
diff --git a/src/portable/microchip/samx7x/dcd_samx7x.c b/src/portable/microchip/samx7x/dcd_samx7x.c index a46fa2cf1..848febc66 100644 --- a/src/portable/microchip/samx7x/dcd_samx7x.c +++ b/src/portable/microchip/samx7x/dcd_samx7x.c @@ -238,8 +238,13 @@ static void dcd_ep_handler(uint8_t ep_ix) if (int_status & USBHS_DEVEPTISR_RXOUTI) { xfer_ctl_t *xfer = &xfer_status[0]; - if (count) + if (count && xfer->total_len) { + uint16_t remain = xfer->total_len - xfer->queued_len; + if (count > remain) + { + count = remain; + } uint8_t *ptr = EP_GET_FIFO_PTR(0,8); if (xfer->buffer) { @@ -256,7 +261,7 @@ static void dcd_ep_handler(uint8_t ep_ix) if ((count < xfer->max_packet_size) || (xfer->queued_len == xfer->total_len)) { // RX COMPLETE - dcd_event_xfer_complete(0, 0, xfer->queued_len, XFER_RESULT_SUCCESS, true); + dcd_event_xfer_complete(0, 0, xfer->total_len, XFER_RESULT_SUCCESS, true); // Disable the interrupt USBHS->USBHS_DEVEPTIDR[0] = USBHS_DEVEPTIDR_RXOUTEC; // Though the host could still send, we don't know. @@ -280,8 +285,13 @@ static void dcd_ep_handler(uint8_t ep_ix) if (int_status & USBHS_DEVEPTISR_RXOUTI) { xfer_ctl_t *xfer = &xfer_status[ep_ix]; - if (count) + if (count && xfer->total_len) { + uint16_t remain = xfer->total_len - xfer->queued_len; + if (count > remain) + { + count = remain; + } uint8_t *ptr = EP_GET_FIFO_PTR(ep_ix,8); if (xfer->buffer) { |