From bc359e55b8d3fb5fc5b9e026d5c21b52d554fdd2 Mon Sep 17 00:00:00 2001 From: HiFiPHile Date: Tue, 1 Sep 2026 10:36:58 +0200 Subject: propagate the endpoint-bound failure on the host path MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit tu_bind_driver_to_ep_itf() now returns false when ep_num >= CFG_TUH_ENDPOINT_MAX, but the host caller ignores that result and continues enumeration. Configurations such as host/bare_api set the limit to 8, while valid USB devices may use endpoints 8–15. A recognized class can therefore continue and later index ep_status[epnum] or ep2drv[epnum] out of bounds. Wrap this call in TU_ASSERT(...), as the device path already does, so parsing fails immediately. Signed-off-by: HiFiPHile --- src/host/usbh.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/host/usbh.c b/src/host/usbh.c index cb4977dd2..69074661d 100644 --- a/src/host/usbh.c +++ b/src/host/usbh.c @@ -2160,8 +2160,8 @@ static bool enum_parse_configuration_desc(uint8_t dev_addr, tusb_desc_configurat TU_LOG_USBH(" %s opened\r\n", driver->name); // bind found driver to all interfaces and endpoint within drv_len - tu_bind_driver_to_ep_itf(drv_id, dev->ep2drv, dev->itf2drv, CFG_TUH_INTERFACE_MAX, CFG_TUH_ENDPOINT_MAX, - p_desc, drv_len); + TU_ASSERT(tu_bind_driver_to_ep_itf(drv_id, dev->ep2drv, dev->itf2drv, CFG_TUH_INTERFACE_MAX, + CFG_TUH_ENDPOINT_MAX, p_desc, drv_len)); p_desc += drv_len; // next Interface break; // exit driver find loop -- cgit v1.3.1