Merge pull request #583 from DanielGibson/fix-hidInterfaces-overflow

HIDUniversal, HIDComposite: Don't overflow hidInterfaces[] or epInfo[]
This commit is contained in:
Kristian Sloth Lauszus 2021-01-13 10:25:01 +01:00 committed by GitHub
commit a60d277427
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 29 additions and 1 deletions

View file

@ -306,6 +306,13 @@ void HIDComposite::EndpointXtract(uint8_t conf, uint8_t iface, uint8_t alt, uint
// Fill in interface structure in case of new interface // Fill in interface structure in case of new interface
if(!piface) { if(!piface) {
if(bNumIface >= maxHidInterfaces) {
// don't overflow hidInterfaces[]
Notify(PSTR("\r\n HIDComposite::EndpointXtract(): Not adding HID interface because we already have "), 0x80);
Notify(bNumIface, 0x80);
Notify(PSTR(" interfaces and can't hold more. "), 0x80);
return;
}
piface = hidInterfaces + bNumIface; piface = hidInterfaces + bNumIface;
piface->bmInterface = iface; piface->bmInterface = iface;
piface->bmAltSet = alt; piface->bmAltSet = alt;
@ -320,6 +327,13 @@ void HIDComposite::EndpointXtract(uint8_t conf, uint8_t iface, uint8_t alt, uint
index = 0; index = 0;
if(index) { if(index) {
if(bNumEP >= totalEndpoints) {
// don't overflow epInfo[] either
Notify(PSTR("\r\n HIDComposite::EndpointXtract(): Not adding endpoint info because we already have "), 0x80);
Notify(bNumEP, 0x80);
Notify(PSTR(" endpoints and can't hold more. "), 0x80);
return;
}
// Fill in the endpoint info structure // Fill in the endpoint info structure
epInfo[bNumEP].epAddr = (pep->bEndpointAddress & 0x0F); epInfo[bNumEP].epAddr = (pep->bEndpointAddress & 0x0F);
epInfo[bNumEP].maxPktSize = (uint8_t)pep->wMaxPacketSize; epInfo[bNumEP].maxPktSize = (uint8_t)pep->wMaxPacketSize;

View file

@ -308,6 +308,13 @@ void HIDUniversal::EndpointXtract(uint8_t conf, uint8_t iface, uint8_t alt, uint
// Fill in interface structure in case of new interface // Fill in interface structure in case of new interface
if(!piface) { if(!piface) {
if(bNumIface >= maxHidInterfaces) {
// don't overflow hidInterfaces[]
Notify(PSTR("\r\n HIDUniversal::EndpointXtract(): Not adding HID interface because we already have "), 0x80);
Notify(bNumIface, 0x80);
Notify(PSTR(" interfaces and can't hold more. "), 0x80);
return;
}
piface = hidInterfaces + bNumIface; piface = hidInterfaces + bNumIface;
piface->bmInterface = iface; piface->bmInterface = iface;
piface->bmAltSet = alt; piface->bmAltSet = alt;
@ -319,6 +326,13 @@ void HIDUniversal::EndpointXtract(uint8_t conf, uint8_t iface, uint8_t alt, uint
index = (pep->bEndpointAddress & 0x80) == 0x80 ? epInterruptInIndex : epInterruptOutIndex; index = (pep->bEndpointAddress & 0x80) == 0x80 ? epInterruptInIndex : epInterruptOutIndex;
if(index) { if(index) {
if(bNumEP >= totalEndpoints) {
// don't overflow epInfo[] either
Notify(PSTR("\r\n HIDUniversal::EndpointXtract(): Not adding endpoint info because we already have "), 0x80);
Notify(bNumEP, 0x80);
Notify(PSTR(" endpoints and can't hold more. "), 0x80);
return;
}
// Fill in the endpoint info structure // Fill in the endpoint info structure
epInfo[bNumEP].epAddr = (pep->bEndpointAddress & 0x0F); epInfo[bNumEP].epAddr = (pep->bEndpointAddress & 0x0F);
epInfo[bNumEP].maxPktSize = (uint8_t)pep->wMaxPacketSize; epInfo[bNumEP].maxPktSize = (uint8_t)pep->wMaxPacketSize;

View file

@ -149,7 +149,7 @@ protected:
static const uint8_t epInterruptInIndex = 1; // InterruptIN endpoint index static const uint8_t epInterruptInIndex = 1; // InterruptIN endpoint index
static const uint8_t epInterruptOutIndex = 2; // InterruptOUT endpoint index static const uint8_t epInterruptOutIndex = 2; // InterruptOUT endpoint index
static const uint8_t maxHidInterfaces = 3; static const uint8_t maxHidInterfaces = 5;
static const uint8_t maxEpPerInterface = 2; static const uint8_t maxEpPerInterface = 2;
static const uint8_t totalEndpoints = (maxHidInterfaces * maxEpPerInterface + 1); // We need to make room for the control endpoint static const uint8_t totalEndpoints = (maxHidInterfaces * maxEpPerInterface + 1); // We need to make room for the control endpoint