From 2e47210c1af88b88b6f2d92fe2b6d08117041363 Mon Sep 17 00:00:00 2001 From: Nathaniel Brough Date: Fri, 13 Jan 2023 13:37:55 -0800 Subject: fix: Replace device calls to memcpy with tu_memcpy_s Introduces a new function tu_memcpy_s, which is effectively a backport of memcpy_s. The change also refactors calls to memcpy over to the more secure tu_memcpy_s. --- src/device/dcd.h | 2 +- src/device/usbd_control.c | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) (limited to 'src/device') diff --git a/src/device/dcd.h b/src/device/dcd.h index c1780f656..3a7e6c5df 100644 --- a/src/device/dcd.h +++ b/src/device/dcd.h @@ -193,7 +193,7 @@ TU_ATTR_ALWAYS_INLINE static inline void dcd_event_bus_reset (uint8_t rhport, t TU_ATTR_ALWAYS_INLINE static inline void dcd_event_setup_received(uint8_t rhport, uint8_t const * setup, bool in_isr) { dcd_event_t event = { .rhport = rhport, .event_id = DCD_EVENT_SETUP_RECEIVED }; - memcpy(&event.setup_received, setup, 8); + memcpy(&event.setup_received, setup, sizeof(tusb_control_request_t)); dcd_event_handler(&event, in_isr); } diff --git a/src/device/usbd_control.c b/src/device/usbd_control.c index 0995ef669..ce4ddab66 100644 --- a/src/device/usbd_control.c +++ b/src/device/usbd_control.c @@ -93,7 +93,9 @@ static bool _data_stage_xact(uint8_t rhport) if ( _ctrl_xfer.request.bmRequestType_bit.direction == TUSB_DIR_IN ) { ep_addr = EDPT_CTRL_IN; - if ( xact_len ) memcpy(_usbd_ctrl_buf, _ctrl_xfer.buffer, xact_len); + if ( xact_len ) { + TU_VERIFY(tu_memcpy_s(_usbd_ctrl_buf, CFG_TUD_ENDPOINT0_SIZE, _ctrl_xfer.buffer, xact_len)==0); + } } return usbd_edpt_xfer(rhport, ep_addr, xact_len ? _usbd_ctrl_buf : NULL, xact_len); -- cgit v1.3.1