diff options
| author | Ha Thach <[email protected]> | 2021-07-05 12:51:07 +0700 |
|---|---|---|
| committer | GitHub <[email protected]> | 2021-07-05 12:51:07 +0700 |
| commit | 2ae19ce40dec5aa13d9eca9b990aa704c2579581 (patch) | |
| tree | e7e30b7b7b98de9162752c178782aed4e78664d6 /src/class | |
| parent | 0a230d57ee6d76b1e861c69f8de2ba937ff15beb (diff) | |
| parent | dfe410ea8beb15b4d85320efeb059f42be647ea6 (diff) | |
Merge pull request #913 from xmos-jmccarthy/master
Add dfu function memory access protection
Diffstat (limited to 'src/class')
| -rw-r--r-- | src/class/dfu/dfu_device.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/src/class/dfu/dfu_device.c b/src/class/dfu/dfu_device.c index 81045ff7b..c696d70a2 100644 --- a/src/class/dfu/dfu_device.c +++ b/src/class/dfu/dfu_device.c @@ -247,7 +247,7 @@ bool dfu_moded_control_xfer_cb(uint8_t rhport, uint8_t stage, tusb_control_reque static uint16_t dfu_req_upload(uint8_t rhport, tusb_control_request_t const * request, uint16_t block_num, uint16_t wLength) { - TU_VERIFY( wLength <= CFG_TUD_DFU_TRANSFER_BUFFER_SIZE); + TU_VERIFY( wLength <= CFG_TUD_DFU_TRANSFER_BUFFER_SIZE, 0); uint16_t retval = tud_dfu_req_upload_data_cb(block_num, (uint8_t *)_dfu_state_ctx.transfer_buf, wLength); tud_control_xfer(rhport, request, _dfu_state_ctx.transfer_buf, retval); return retval; @@ -276,6 +276,7 @@ static void dfu_req_dnload_setup(uint8_t rhport, tusb_control_request_t const * // if they wish, there still will be the internal control buffer copy to this buffer // but this mode would provide zero copy from the class driver to the application + TU_VERIFY( request->wLength <= CFG_TUD_DFU_TRANSFER_BUFFER_SIZE, ); // setup for data phase tud_control_xfer(rhport, request, _dfu_state_ctx.transfer_buf, request->wLength); } @@ -283,6 +284,7 @@ static void dfu_req_dnload_setup(uint8_t rhport, tusb_control_request_t const * static void dfu_req_dnload_reply(uint8_t rhport, tusb_control_request_t const * request) { (void) rhport; + TU_VERIFY( request->wLength <= CFG_TUD_DFU_TRANSFER_BUFFER_SIZE, ); tud_dfu_req_dnload_data_cb(request->wValue, (uint8_t *)_dfu_state_ctx.transfer_buf, request->wLength); _dfu_state_ctx.blk_transfer_in_proc = false; } |