andy/tinyUSB
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Merge pull request #2964 from hathach/fix-2939

Browse Source 
fix bug introduced by 2939, with correct offset check logic
This commit is contained in:
Ha Thach
2025-01-25 23:46:06 +07:00
committed by GitHub
parent 597446fbea f6f02f1893
commit 37e6f49619
2 changed files with 13 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
examples/device/cdc_msc/src/msc_disk.c
View File

@@ -190,10 +190,14 @@ int32_t tud_msc_read10_cb(uint8_t lun, uint32_t lba, uint32_t offset, void* buff
(void) lun;
// out of ramdisk
if ( lba >= DISK_BLOCK_NUM ) return -1;
if ( lba >= DISK_BLOCK_NUM ) {
return -1;
}
// Check for overflow of offset + bufsize
if ( offset + bufsize >= DISK_BLOCK_SIZE ) return -1;
if ( offset + bufsize > DISK_BLOCK_SIZE ) {
return -1;
}
uint8_t const* addr = msc_disk[lba] + offset;
memcpy(buffer, addr, bufsize);

9
examples/device/cdc_msc_freertos/src/msc_disk.c
View File

@@ -190,9 +190,14 @@ int32_t tud_msc_read10_cb(uint8_t lun, uint32_t lba, uint32_t offset, void* buff
(void) lun;
// out of ramdisk
if ( lba >= DISK_BLOCK_NUM ) return -1;
if ( lba >= DISK_BLOCK_NUM ) {
return -1;
}
// Check for overflow of offset + bufsize
if ( offset + bufsize >= DISK_BLOCK_SIZE ) return -1;
if ( offset + bufsize > DISK_BLOCK_SIZE ) {
return -1;
}
uint8_t const* addr = msc_disk[lba] + offset;
memcpy(buffer, addr, bufsize);