diff options
| author | Jerzy Kasenberg <[email protected]> | 2020-08-24 09:01:03 +0200 |
|---|---|---|
| committer | Jerzy Kasenberg <[email protected]> | 2020-08-24 09:04:42 +0200 |
| commit | c61e9fb96def7b77b4001374b362141a29dcba5b (patch) | |
| tree | 6c724cf8533916675bad8e7a94f080340df35d19 /src/class | |
| parent | 37be0ca73238a40a2387c2e2566ae39f5cae6e08 (diff) | |
audio_device: Fix descriptor limit calculation
In several place p_desc_end calculation was not taking into account
that starting pointer (_audiod_itf[idxDriver].p_desc) was pointing
past interface association descriptor.
It would result in accessing random memory.
Diffstat (limited to 'src/class')
| -rw-r--r-- | src/class/audio/audio_device.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/src/class/audio/audio_device.c b/src/class/audio/audio_device.c index 6fe5d6717..f8676d4b5 100644 --- a/src/class/audio/audio_device.c +++ b/src/class/audio/audio_device.c @@ -689,7 +689,7 @@ static bool audiod_set_interface(uint8_t rhport, tusb_control_request_t const * // Open new EP if necessary - EPs are only to be closed or opened for AS interfaces - Look for AS interface with correct alternate interface // Get pointer at end - uint8_t const *p_desc_end = _audiod_itf[idxDriver].p_desc + tud_audio_desc_lengths[idxDriver]; + uint8_t const *p_desc_end = _audiod_itf[idxDriver].p_desc + tud_audio_desc_lengths[idxDriver] - TUD_AUDIO_DESC_IAD_LEN; // p_desc starts at required interface with alternate setting zero while (p_desc < p_desc_end) @@ -1113,7 +1113,7 @@ static bool audiod_get_AS_interface_index(uint8_t itf, uint8_t *idxDriver, uint8 if (_audiod_itf[i].p_desc) { // Get pointer at end - uint8_t const *p_desc_end = _audiod_itf[i].p_desc + tud_audio_desc_lengths[i]; + uint8_t const *p_desc_end = _audiod_itf[i].p_desc + tud_audio_desc_lengths[i] - TUD_AUDIO_DESC_IAD_LEN; // Advance past AC descriptors uint8_t const *p_desc = tu_desc_next(_audiod_itf[i].p_desc); @@ -1178,7 +1178,7 @@ static bool audiod_verify_itf_exists(uint8_t itf, uint8_t *idxDriver) { // Get pointer at beginning and end uint8_t const *p_desc = _audiod_itf[i].p_desc; - uint8_t const *p_desc_end = _audiod_itf[i].p_desc + tud_audio_desc_lengths[i]; + uint8_t const *p_desc_end = _audiod_itf[i].p_desc + tud_audio_desc_lengths[i] - TUD_AUDIO_DESC_IAD_LEN; while (p_desc < p_desc_end) { |