diff options
| author | HiFiPhile <[email protected]> | 2025-01-25 18:04:00 +0100 |
|---|---|---|
| committer | HiFiPhile <[email protected]> | 2025-01-25 18:04:00 +0100 |
| commit | 9cfa328261b82194b924db03535134a4167605d8 (patch) | |
| tree | 5ea3bba945b168ad7afe0965321c816a3abcbe08 /examples | |
| parent | 979d79095953ee0cad25438aa560dbb032af2bd0 (diff) | |
| parent | 37e6f496197e0bc35ca0f71cfef80c19be273ca3 (diff) | |
Merge branch 'master' into h7rs
Diffstat (limited to 'examples')
| -rw-r--r-- | examples/device/cdc_msc/src/msc_disk.c | 9 | ||||
| -rw-r--r-- | examples/device/cdc_msc_freertos/src/msc_disk.c | 9 |
2 files changed, 16 insertions, 2 deletions
diff --git a/examples/device/cdc_msc/src/msc_disk.c b/examples/device/cdc_msc/src/msc_disk.c index d2f8628f1..d325d77fa 100644 --- a/examples/device/cdc_msc/src/msc_disk.c +++ b/examples/device/cdc_msc/src/msc_disk.c @@ -190,7 +190,14 @@ int32_t tud_msc_read10_cb(uint8_t lun, uint32_t lba, uint32_t offset, void* buff (void) lun; // out of ramdisk - if ( lba >= DISK_BLOCK_NUM ) return -1; + if ( lba >= DISK_BLOCK_NUM ) { + return -1; + } + + // Check for overflow of offset + bufsize + if ( offset + bufsize > DISK_BLOCK_SIZE ) { + return -1; + } uint8_t const* addr = msc_disk[lba] + offset; memcpy(buffer, addr, bufsize); diff --git a/examples/device/cdc_msc_freertos/src/msc_disk.c b/examples/device/cdc_msc_freertos/src/msc_disk.c index d2f8628f1..d325d77fa 100644 --- a/examples/device/cdc_msc_freertos/src/msc_disk.c +++ b/examples/device/cdc_msc_freertos/src/msc_disk.c @@ -190,7 +190,14 @@ int32_t tud_msc_read10_cb(uint8_t lun, uint32_t lba, uint32_t offset, void* buff (void) lun; // out of ramdisk - if ( lba >= DISK_BLOCK_NUM ) return -1; + if ( lba >= DISK_BLOCK_NUM ) { + return -1; + } + + // Check for overflow of offset + bufsize + if ( offset + bufsize > DISK_BLOCK_SIZE ) { + return -1; + } uint8_t const* addr = msc_disk[lba] + offset; memcpy(buffer, addr, bufsize); |