andy/tinyUSB
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

msc_disk: fix overflow check when EP buffer size > 512.

Browse Source 
Signed-off-by: HiFiPhile <admin@hifiphile.com>
This commit is contained in:
HiFiPhile
2025-01-29 15:20:44 +01:00
parent cc626f35d2
commit 04b9e20310
2 changed files with 18 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
examples/device/cdc_msc/src/msc_disk.c
View File

@@ -195,7 +195,7 @@ int32_t tud_msc_read10_cb(uint8_t lun, uint32_t lba, uint32_t offset, void* buff
}
// Check for overflow of offset + bufsize
if ( offset + bufsize > DISK_BLOCK_SIZE ) {
if ( lba * DISK_BLOCK_SIZE + offset + bufsize > DISK_BLOCK_NUM * DISK_BLOCK_SIZE ) {
return -1;
}
@@ -223,7 +223,14 @@ int32_t tud_msc_write10_cb(uint8_t lun, uint32_t lba, uint32_t offset, uint8_t*
(void) lun;
// out of ramdisk
if ( lba >= DISK_BLOCK_NUM ) return -1;
if ( lba >= DISK_BLOCK_NUM ) {
return -1;
}
// Check for overflow of offset + bufsize
if ( lba * DISK_BLOCK_SIZE + offset + bufsize > DISK_BLOCK_NUM * DISK_BLOCK_SIZE ) {
return -1;
}
#ifndef CFG_EXAMPLE_MSC_READONLY
uint8_t* addr = msc_disk[lba] + offset;

11
examples/device/cdc_msc_freertos/src/msc_disk.c
View File

@@ -195,7 +195,7 @@ int32_t tud_msc_read10_cb(uint8_t lun, uint32_t lba, uint32_t offset, void* buff
}
// Check for overflow of offset + bufsize
if ( offset + bufsize > DISK_BLOCK_SIZE ) {
if ( lba * DISK_BLOCK_SIZE + offset + bufsize > DISK_BLOCK_NUM * DISK_BLOCK_SIZE ) {
return -1;
}
@@ -223,7 +223,14 @@ int32_t tud_msc_write10_cb(uint8_t lun, uint32_t lba, uint32_t offset, uint8_t*
(void) lun;
// out of ramdisk
if ( lba >= DISK_BLOCK_NUM ) return -1;
if ( lba >= DISK_BLOCK_NUM ) {
return -1;
}
// Check for overflow of offset + bufsize
if ( lba * DISK_BLOCK_SIZE + offset + bufsize > DISK_BLOCK_NUM * DISK_BLOCK_SIZE ) {
return -1;
}
#ifndef CFG_EXAMPLE_MSC_READONLY
uint8_t* addr = msc_disk[lba] + offset;