summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorFrédéric Desbiens <[email protected]>2025-09-29 19:50:43 +0100
committerGitHub <[email protected]>2025-09-29 19:50:43 +0100
commitb1145c29e97208bef5a2dd6647a202cb679897fa (patch)
treee5fd15dafa16017bfbd67e93c3f6ac9cd743b7c1
parent52d25b55729f19c39ec13c86ab578047351862e7 (diff)
parente9ef4054f74158e9e4ad734e4f34b48b21b6b6de (diff)
Merge commit from fork
add bounds check for frequency array in audio streaming interface descriptor
Diffstat
-rw-r--r--common/usbx_host_classes/src/ux_host_class_audio_streaming_sampling_get.c183
1 files changed, 120 insertions, 63 deletions
diff --git a/common/usbx_host_classes/src/ux_host_class_audio_streaming_sampling_get.c b/common/usbx_host_classes/src/ux_host_class_audio_streaming_sampling_get.c
index bb3aefb..04de8b3 100644
--- a/common/usbx_host_classes/src/ux_host_class_audio_streaming_sampling_get.c
+++ b/common/usbx_host_classes/src/ux_host_class_audio_streaming_sampling_get.c
@@ -11,8 +11,8 @@
/**************************************************************************/
/**************************************************************************/
-/** */
-/** USBX Component */
+/** */
+/** USBX Component */
/** */
/** Audio Class */
/** */
@@ -29,48 +29,48 @@
#include "ux_host_stack.h"
-/**************************************************************************/
-/* */
-/* FUNCTION RELEASE */
-/* */
-/* _ux_host_class_audio_streaming_sampling_get PORTABLE C */
+/**************************************************************************/
+/* */
+/* FUNCTION RELEASE */
+/* */
+/* _ux_host_class_audio_streaming_sampling_get PORTABLE C */
/* 6.1.12 */
/* AUTHOR */
/* */
/* Chaoqiong Xiao, Microsoft Corporation */
/* */
/* DESCRIPTION */
-/* */
-/* This function obtains successive sampling characteristics for the */
-/* audio streaming channel. */
+/* */
+/* This function obtains successive sampling characteristics for the */
+/* audio streaming channel. */
/* */
/* Note only Audio 1.0 and RAW (PCM like) format is supported. */
-/* */
-/* INPUT */
-/* */
-/* audio Pointer to audio class */
-/* audio_sampling Pointer to audio sampling */
-/* */
-/* OUTPUT */
-/* */
-/* Completion Status */
-/* */
-/* CALLS */
-/* */
-/* _ux_host_stack_class_instance_verify Verify instance is valid */
-/* _ux_utility_descriptor_parse Parse the descriptor */
+/* */
+/* INPUT */
+/* */
+/* audio Pointer to audio class */
+/* audio_sampling Pointer to audio sampling */
+/* */
+/* OUTPUT */
+/* */
+/* Completion Status */
+/* */
+/* CALLS */
+/* */
+/* _ux_host_stack_class_instance_verify Verify instance is valid */
+/* _ux_utility_descriptor_parse Parse the descriptor */
/* _ux_host_mutex_on Get mutex */
/* _ux_host_mutex_off Put mutex */
-/* */
-/* CALLED BY */
-/* */
-/* Application */
-/* Audio Class */
-/* */
-/* RELEASE HISTORY */
-/* */
-/* DATE NAME DESCRIPTION */
-/* */
+/* */
+/* CALLED BY */
+/* */
+/* Application */
+/* Audio Class */
+/* */
+/* RELEASE HISTORY */
+/* */
+/* DATE NAME DESCRIPTION */
+/* */
/* 05-19-2020 Chaoqiong Xiao Initial Version 6.0 */
/* 09-30-2020 Chaoqiong Xiao Modified comment(s), */
/* resulting in version 6.1 */
@@ -101,13 +101,13 @@ ULONG lower_frequency;
ULONG higher_frequency;
UINT specific_frequency_count;
UINT previous_match_found;
-
+
/* If trace is enabled, insert this event into the trace buffer. */
UX_TRACE_IN_LINE_INSERT(UX_TRACE_HOST_CLASS_AUDIO_STREAMING_SAMPLING_GET, audio, 0, 0, 0, UX_TRACE_HOST_CLASS_EVENTS, 0, 0)
/* Ensure the instance is valid. */
if (_ux_host_stack_class_instance_verify(_ux_system_host_class_audio_name, (VOID *) audio) != UX_SUCCESS)
- {
+ {
/* Error trap. */
_ux_system_error_handler(UX_SYSTEM_LEVEL_THREAD, UX_SYSTEM_CONTEXT_CLASS, UX_HOST_CLASS_INSTANCE_UNKNOWN);
@@ -127,18 +127,16 @@ UINT previous_match_found;
/* Get the descriptor to the entire configuration. */
descriptor = audio -> ux_host_class_audio_configuration_descriptor;
total_descriptor_length = audio -> ux_host_class_audio_configuration_descriptor_length;
-
- /* Default is Interface descriptor not yet found. */
+
+ /* Default is Interface descriptor not yet found. */
interface_found = UX_FALSE;
-
+
/* Scan the descriptor for the Audio Streaming interface. */
while (total_descriptor_length)
{
/* Gather the length, type and subtype of the descriptor. */
descriptor_length = *descriptor;
- descriptor_type = *(descriptor + 1);
- descriptor_subtype = *(descriptor + 2);
/* Make sure this descriptor has at least the minimum length. */
if (descriptor_length < 3)
@@ -156,6 +154,9 @@ UINT previous_match_found;
return(UX_DESCRIPTOR_CORRUPTED);
}
+ descriptor_type = *(descriptor + 1);
+ descriptor_subtype = *(descriptor + 2);
+
/* Process relative to descriptor type. */
switch(descriptor_type)
{
@@ -180,7 +181,7 @@ UINT previous_match_found;
interface_found = UX_FALSE;
}
break;
-
+
case UX_HOST_CLASS_AUDIO_CS_INTERFACE:
@@ -193,12 +194,12 @@ UINT previous_match_found;
UX_HOST_CLASS_AUDIO_INTERFACE_DESCRIPTOR_ENTRIES, (UCHAR *) &audio_interface_descriptor);
/* This descriptor must refer to a PCM audio type. */
- if (audio_interface_descriptor.bFormatType != UX_HOST_CLASS_AUDIO_FORMAT_TYPE_I)
+ if (audio_interface_descriptor.bFormatType != UX_HOST_CLASS_AUDIO_FORMAT_TYPE_I)
break;
/* If this is the first time we ask for a streaming interface characteristics
we return the first we find. */
- if ((audio_sampling -> ux_host_class_audio_sampling_characteristics_channels == 0) &&
+ if ((audio_sampling -> ux_host_class_audio_sampling_characteristics_channels == 0) &&
(audio_sampling -> ux_host_class_audio_sampling_characteristics_resolution == 0))
{
@@ -207,24 +208,52 @@ UINT previous_match_found;
if (audio_interface_descriptor.bSamFreqType == 0)
{
-
+
+ if (descriptor_length < (UX_HOST_CLASS_AUDIO_INTERFACE_DESCRIPTOR_LENGTH + 6))
+ {
+ /* Error trap. */
+ _ux_system_error_handler(UX_SYSTEM_LEVEL_THREAD, UX_SYSTEM_CONTEXT_CLASS, UX_DESCRIPTOR_CORRUPTED);
+
+ /* If trace is enabled, insert this event into the trace buffer. */
+ UX_TRACE_IN_LINE_INSERT(UX_TRACE_ERROR, UX_DESCRIPTOR_CORRUPTED, descriptor, 0, 0, UX_TRACE_ERRORS, 0, 0)
+
+ /* Unprotect thread reentry to this instance. */
+ _ux_host_mutex_off(&audio -> ux_host_class_audio_mutex);
+
+ return(UX_DESCRIPTOR_CORRUPTED);
+ }
+
/* The declaration of frequency is contiguous, so get the minimum and maximum */
- audio_sampling -> ux_host_class_audio_sampling_characteristics_frequency_low =
+ audio_sampling -> ux_host_class_audio_sampling_characteristics_frequency_low =
(ULONG) *(descriptor + UX_HOST_CLASS_AUDIO_INTERFACE_DESCRIPTOR_LENGTH) |
((ULONG) *(descriptor + UX_HOST_CLASS_AUDIO_INTERFACE_DESCRIPTOR_LENGTH + 1)) << 8 |
((ULONG) *(descriptor + UX_HOST_CLASS_AUDIO_INTERFACE_DESCRIPTOR_LENGTH + 2)) << 16;
- audio_sampling -> ux_host_class_audio_sampling_characteristics_frequency_high =
+ audio_sampling -> ux_host_class_audio_sampling_characteristics_frequency_high =
(ULONG) *(descriptor + UX_HOST_CLASS_AUDIO_INTERFACE_DESCRIPTOR_LENGTH + 3) |
- ((ULONG) *(descriptor + UX_HOST_CLASS_AUDIO_INTERFACE_DESCRIPTOR_LENGTH + 4)) << 8 |
+ ((ULONG) *(descriptor + UX_HOST_CLASS_AUDIO_INTERFACE_DESCRIPTOR_LENGTH + 4)) << 8 |
((ULONG) *(descriptor + UX_HOST_CLASS_AUDIO_INTERFACE_DESCRIPTOR_LENGTH + 5)) << 16;
}
else
{
- /* The declaration of the frequency is declared as an array of specific values.
+ if (descriptor_length < (UX_HOST_CLASS_AUDIO_INTERFACE_DESCRIPTOR_LENGTH + (3 * audio_interface_descriptor.bSamFreqType)))
+ {
+ /* Error trap. */
+ _ux_system_error_handler(UX_SYSTEM_LEVEL_THREAD, UX_SYSTEM_CONTEXT_CLASS, UX_DESCRIPTOR_CORRUPTED);
+
+ /* If trace is enabled, insert this event into the trace buffer. */
+ UX_TRACE_IN_LINE_INSERT(UX_TRACE_ERROR, UX_DESCRIPTOR_CORRUPTED, descriptor, 0, 0, UX_TRACE_ERRORS, 0, 0)
+
+ /* Unprotect thread reentry to this instance. */
+ _ux_host_mutex_off(&audio -> ux_host_class_audio_mutex);
+
+ return(UX_DESCRIPTOR_CORRUPTED);
+ }
+
+ /* The declaration of the frequency is declared as an array of specific values.
We take the first one here. */
- audio_sampling -> ux_host_class_audio_sampling_characteristics_frequency_low =
+ audio_sampling -> ux_host_class_audio_sampling_characteristics_frequency_low =
(ULONG) *(descriptor + UX_HOST_CLASS_AUDIO_INTERFACE_DESCRIPTOR_LENGTH ) |
((ULONG) *(descriptor + UX_HOST_CLASS_AUDIO_INTERFACE_DESCRIPTOR_LENGTH + 1 )) << 8 |
((ULONG) *(descriptor + UX_HOST_CLASS_AUDIO_INTERFACE_DESCRIPTOR_LENGTH + 2 )) << 16;
@@ -248,16 +277,30 @@ UINT previous_match_found;
(audio_sampling -> ux_host_class_audio_sampling_characteristics_resolution == audio_interface_descriptor.bBitResolution))
{
- if (audio_interface_descriptor.bSamFreqType == 0)
- {
-
+ if (audio_interface_descriptor.bSamFreqType == 0)
+ {
+
+ if (descriptor_length < (UX_HOST_CLASS_AUDIO_INTERFACE_DESCRIPTOR_LENGTH + 6))
+ {
+ /* Error trap. */
+ _ux_system_error_handler(UX_SYSTEM_LEVEL_THREAD, UX_SYSTEM_CONTEXT_CLASS, UX_DESCRIPTOR_CORRUPTED);
+
+ /* If trace is enabled, insert this event into the trace buffer. */
+ UX_TRACE_IN_LINE_INSERT(UX_TRACE_ERROR, UX_DESCRIPTOR_CORRUPTED, descriptor, 0, 0, UX_TRACE_ERRORS, 0, 0)
+
+ /* Unprotect thread reentry to this instance. */
+ _ux_host_mutex_off(&audio -> ux_host_class_audio_mutex);
+
+ return(UX_DESCRIPTOR_CORRUPTED);
+ }
+
/* The declaration of frequency is contiguous, so get the minimum and maximum. */
lower_frequency = (ULONG) *(descriptor + UX_HOST_CLASS_AUDIO_INTERFACE_DESCRIPTOR_LENGTH) |
((ULONG) *(descriptor + UX_HOST_CLASS_AUDIO_INTERFACE_DESCRIPTOR_LENGTH + 1)) << 8 |
((ULONG) *(descriptor + UX_HOST_CLASS_AUDIO_INTERFACE_DESCRIPTOR_LENGTH + 2)) << 16;
higher_frequency = (ULONG) *(descriptor + UX_HOST_CLASS_AUDIO_INTERFACE_DESCRIPTOR_LENGTH + 3) |
- ((ULONG) *(descriptor + UX_HOST_CLASS_AUDIO_INTERFACE_DESCRIPTOR_LENGTH + 4)) << 8 |
+ ((ULONG) *(descriptor + UX_HOST_CLASS_AUDIO_INTERFACE_DESCRIPTOR_LENGTH + 4)) << 8 |
((ULONG) *(descriptor + UX_HOST_CLASS_AUDIO_INTERFACE_DESCRIPTOR_LENGTH + 5)) << 16;
if ((audio_sampling -> ux_host_class_audio_sampling_characteristics_frequency_low == lower_frequency) &&
@@ -272,6 +315,20 @@ UINT previous_match_found;
else
{
+ if (descriptor_length < UX_HOST_CLASS_AUDIO_INTERFACE_DESCRIPTOR_LENGTH + (3 * audio_interface_descriptor.bSamFreqType))
+ {
+ /* Error trap. */
+ _ux_system_error_handler(UX_SYSTEM_LEVEL_THREAD, UX_SYSTEM_CONTEXT_CLASS, UX_DESCRIPTOR_CORRUPTED);
+
+ /* If trace is enabled, insert this event into the trace buffer. */
+ UX_TRACE_IN_LINE_INSERT(UX_TRACE_ERROR, UX_DESCRIPTOR_CORRUPTED, descriptor, 0, 0, UX_TRACE_ERRORS, 0, 0)
+
+ /* Unprotect thread reentry to this instance. */
+ _ux_host_mutex_off(&audio -> ux_host_class_audio_mutex);
+
+ return(UX_DESCRIPTOR_CORRUPTED);
+ }
+
/* The declaration of the frequency is declared as an array of specific values. */
for (specific_frequency_count = 0; specific_frequency_count < audio_interface_descriptor.bSamFreqType; specific_frequency_count++)
{
@@ -283,7 +340,7 @@ UINT previous_match_found;
/* Compare the frequency. */
if (audio_sampling -> ux_host_class_audio_sampling_characteristics_frequency_low == lower_frequency)
{
-
+
previous_match_found = UX_TRUE;
}
else
@@ -306,7 +363,7 @@ UINT previous_match_found;
/* Return successful completion. */
return(UX_SUCCESS);
}
- }
+ }
}
}
}
@@ -325,14 +382,14 @@ UINT previous_match_found;
if (audio_interface_descriptor.bSamFreqType == 0)
{
-
+
/* The declaration of frequency is contiguous, so get the minimum and maximum. */
lower_frequency = (ULONG) *(descriptor + UX_HOST_CLASS_AUDIO_INTERFACE_DESCRIPTOR_LENGTH) |
((ULONG) *(descriptor + UX_HOST_CLASS_AUDIO_INTERFACE_DESCRIPTOR_LENGTH + 1)) << 8 |
((ULONG) *(descriptor + UX_HOST_CLASS_AUDIO_INTERFACE_DESCRIPTOR_LENGTH + 2)) << 16;
higher_frequency = (ULONG) *(descriptor + UX_HOST_CLASS_AUDIO_INTERFACE_DESCRIPTOR_LENGTH + 3) |
- ((ULONG) *(descriptor + UX_HOST_CLASS_AUDIO_INTERFACE_DESCRIPTOR_LENGTH + 4)) << 8 |
+ ((ULONG) *(descriptor + UX_HOST_CLASS_AUDIO_INTERFACE_DESCRIPTOR_LENGTH + 4)) << 8 |
((ULONG) *(descriptor + UX_HOST_CLASS_AUDIO_INTERFACE_DESCRIPTOR_LENGTH + 5)) << 16;
audio_sampling -> ux_host_class_audio_sampling_characteristics_frequency_low = lower_frequency;
@@ -344,7 +401,7 @@ UINT previous_match_found;
/* Return successful completion. */
return(UX_SUCCESS);
}
- else
+ else
{
lower_frequency = (ULONG) *(descriptor + UX_HOST_CLASS_AUDIO_INTERFACE_DESCRIPTOR_LENGTH) |
@@ -362,9 +419,9 @@ UINT previous_match_found;
}
}
}
- }
+ }
}
- }
+ }
/* Verify the descriptor is still valid. */
if (descriptor_length > total_descriptor_length)
@@ -421,8 +478,8 @@ UINT previous_match_found;
/* */
/* INPUT */
/* */
-/* audio Pointer to audio class */
-/* audio_sampling Pointer to audio sampling */
+/* audio Pointer to audio class */
+/* audio_sampling Pointer to audio sampling */
/* */
/* OUTPUT */
/* */
generated by cgit v1.3.1 (git 2.54.0) at 2026-08-13 10:00:05 +0000