diff options
| author | Ryzee119 <[email protected]> | 2022-01-28 14:02:34 +1030 |
|---|---|---|
| committer | GitHub <[email protected]> | 2022-01-28 14:02:34 +1030 |
| commit | 453ba529a6db41ad9e0e8cbfdedfcb48b059693e (patch) | |
| tree | d84977aa6b6e11ba4c7aa67f0aa84948b280d258 /src | |
| parent | ffb257ac17f162bc5a4c26596d7a1e954db98aa5 (diff) | |
OHCI: Fix array out of bounds issue
If using a USB hub, a request outside the array size can occur
Original line:
https://github.com/hathach/tinyusb/blob/ffb257ac17f162bc5a4c26596d7a1e954db98aa5/src/portable/ohci/ohci.h#L162
It can happen in a few places but one such example is here:
https://github.com/hathach/tinyusb/blob/ffb257ac17f162bc5a4c26596d7a1e954db98aa5/src/portable/ohci/ohci.c#L460
ie. if HUB address is 5, this would be an array index out of bounds on control endpoints as `CFG_TUH_DEVICE_MAX+1` is only 5.
This fix just includes num of hubs in the reserve array size.
Fixing locally fixed this issue.
Diffstat (limited to 'src')
| -rw-r--r-- | src/portable/ohci/ohci.h | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/portable/ohci/ohci.h b/src/portable/ohci/ohci.h index cd90aa45a..8db097b06 100644 --- a/src/portable/ohci/ohci.h +++ b/src/portable/ohci/ohci.h @@ -159,7 +159,7 @@ typedef struct TU_ATTR_ALIGNED(256) struct { ohci_ed_t ed; ohci_gtd_t gtd; - }control[CFG_TUH_DEVICE_MAX+1]; + }control[CFG_TUH_DEVICE_MAX+CFG_TUH_HUB+1]; // ochi_itd_t itd[OHCI_MAX_ITD]; // itd requires alignment of 32 ohci_ed_t ed_pool[HCD_MAX_ENDPOINT]; |