Fixed issue where pointer size was used instead of buffer size in ux_host_class_hid_report_item_analyse

4 files changed, 19 insertions, 9 deletions

diff --git a/common/usbx_host_classes/inc/ux_host_class_hid.h b/common/usbx_host_classes/inc/ux_host_class_hid.h
index a8b54fd..b10f605 100644
--- a/common/usbx_host_classes/inc/ux_host_class_hid.h
+++ b/common/usbx_host_classes/inc/ux_host_class_hid.h
@@ -1069,7 +1069,7 @@ UINT    _ux_host_class_hid_report_decompress(UX_HOST_CLASS_HID *hid, UX_HOST_CLA
 UINT    _ux_host_class_hid_report_descriptor_get(UX_HOST_CLASS_HID *hid, ULONG length);
 UINT    _ux_host_class_hid_report_get(UX_HOST_CLASS_HID *hid, UX_HOST_CLASS_HID_CLIENT_REPORT *client_report);
 UINT    _ux_host_class_hid_report_id_get(UX_HOST_CLASS_HID *hid, UX_HOST_CLASS_HID_REPORT_GET_ID *report_id);
-UINT    _ux_host_class_hid_report_item_analyse(UCHAR *descriptor, UX_HOST_CLASS_HID_ITEM *item);
+UINT    _ux_host_class_hid_report_item_analyse(UCHAR *descriptor, ULONG length, UX_HOST_CLASS_HID_ITEM *item);
 UINT    _ux_host_class_hid_report_set(UX_HOST_CLASS_HID *hid, UX_HOST_CLASS_HID_CLIENT_REPORT *client_report);
 UINT    _ux_host_class_hid_resources_free(UX_HOST_CLASS_HID *hid);
 VOID    _ux_host_class_hid_transfer_request_completed(UX_TRANSFER *transfer_request);
diff --git a/common/usbx_host_classes/src/ux_host_class_hid_entry.c b/common/usbx_host_classes/src/ux_host_class_hid_entry.c
index f8e3e5b..0902432 100644
--- a/common/usbx_host_classes/src/ux_host_class_hid_entry.c
+++ b/common/usbx_host_classes/src/ux_host_class_hid_entry.c
@@ -358,7 +358,7 @@ UINT                    status = UX_SUCCESS;
     {
 
         /* Get one item from the report and analyze it.  */
-        _ux_host_class_hid_report_item_analyse(descriptor, &item);
+        _ux_host_class_hid_report_item_analyse(descriptor, length, &item);
 
         /* Point the descriptor right after the item identifier.  */
         descriptor +=  item.ux_host_class_hid_item_report_format;
diff --git a/common/usbx_host_classes/src/ux_host_class_hid_report_descriptor_get.c b/common/usbx_host_classes/src/ux_host_class_hid_report_descriptor_get.c
index ce80f37..5f383fb 100644
--- a/common/usbx_host_classes/src/ux_host_class_hid_report_descriptor_get.c
+++ b/common/usbx_host_classes/src/ux_host_class_hid_report_descriptor_get.c
@@ -111,7 +111,7 @@ UINT                    status;
         {
             /* Get one item from the report and analyze it.  */
             /* Make sure this descriptor has at least the minimum length.  */
-            analysis_failure = _ux_host_class_hid_report_item_analyse(descriptor, &item);
+            analysis_failure = _ux_host_class_hid_report_item_analyse(descriptor, length, &item);
             if (analysis_failure)
             {
               /* Error trap. */
diff --git a/common/usbx_host_classes/src/ux_host_class_hid_report_item_analyse.c b/common/usbx_host_classes/src/ux_host_class_hid_report_item_analyse.c
index db1e2fe..8d60189 100644
--- a/common/usbx_host_classes/src/ux_host_class_hid_report_item_analyse.c
+++ b/common/usbx_host_classes/src/ux_host_class_hid_report_item_analyse.c
@@ -47,6 +47,7 @@
 /*  INPUT                                                                 */
 /*                                                                        */
 /*    descriptor                            Pointer to descriptor         */
+/*    length                                Length of descriptor          */
 /*    item                                  Pointer to item               */
 /*                                                                        */
 /*  OUTPUT                                                                */
@@ -62,12 +63,18 @@
 /*    HID Class                                                           */
 /*                                                                        */
 /**************************************************************************/
-UINT  _ux_host_class_hid_report_item_analyse(UCHAR *descriptor, UX_HOST_CLASS_HID_ITEM *item)
+UINT  _ux_host_class_hid_report_item_analyse(UCHAR *descriptor, ULONG length, UX_HOST_CLASS_HID_ITEM *item)
 {
 
 UCHAR       item_byte;
 UINT        result = UX_SUCCESS;
 
+    /* Make sure descriptor has minimal length.*/
+    if (length == 0)
+    {
+        return(UX_DESCRIPTOR_CORRUPTED);
+    }
+
     /* Get the first byte from the descriptor.  */
     item_byte =  *descriptor;
 
@@ -83,7 +90,7 @@ UINT        result = UX_SUCCESS;
         item -> ux_host_class_hid_item_report_type =  (item_byte >> 2) & 3;
 
         /* Make sure descriptor has minimal length.*/
-        if (sizeof(descriptor) >= 3)
+        if (length >= 3)
         {
             /* Get its length (byte 1).  */
             item -> ux_host_class_hid_item_report_length =  (USHORT) *(descriptor + 1);
@@ -120,11 +127,14 @@ UINT        result = UX_SUCCESS;
         /* Set the type.  */
         item -> ux_host_class_hid_item_report_type =  (item_byte >> 2) & 3;
 
-        /* Set the tag.  */
-        item -> ux_host_class_hid_item_report_tag =  item_byte >> 4;
+        /* Then the tag.  */
+        item -> ux_host_class_hid_item_report_tag =  (item_byte >> 4) & 0xf;
+
+        /* Mark its format. For short items, this is always 1. */
+        item -> ux_host_class_hid_item_report_format = 1;
+
     }
 
-    /* Return successful completion.  */
+    /* Return result.  */
     return(result);
 }
-