Skip to content

Commit 89e67d3

Browse files
update USBMSD::memoryRead implementation
Fix protects underlaying block device from out-of-bound reads
1 parent ac105f5 commit 89e67d3

File tree

1 file changed

+13
-11
lines changed

1 file changed

+13
-11
lines changed

drivers/source/usb/USBMSD.cpp

Lines changed: 13 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -876,23 +876,25 @@ void USBMSD::memoryRead(void)
876876

877877
n = (_length > MAX_PACKET) ? MAX_PACKET : _length;
878878

879-
if ((_addr + n) > _memory_size) {
880-
n = _memory_size - _addr;
879+
if (_addr > (_memory_size - n)) {
880+
n = _addr < _memory_size ? _memory_size - _addr : 0;
881881
_stage = ERROR;
882882
}
883883

884-
// we read an entire block
885-
if (!(_addr % _block_size)) {
886-
disk_read(_page, _addr / _block_size, 1);
887-
}
884+
if (n > 0) {
885+
// we read an entire block
886+
if (!(_addr % _block_size)) {
887+
disk_read(_page, _addr / _block_size, 1);
888+
}
888889

889-
// write data which are in RAM
890-
_write_next(&_page[_addr % _block_size], MAX_PACKET);
890+
// write data which are in RAM
891+
_write_next(&_page[_addr % _block_size], MAX_PACKET);
891892

892-
_addr += n;
893-
_length -= n;
893+
_addr += n;
894+
_length -= n;
894895

895-
_csw.DataResidue -= n;
896+
_csw.DataResidue -= n;
897+
}
896898

897899
if (!_length || (_stage != PROCESS_CBW)) {
898900
_csw.Status = (_stage == PROCESS_CBW) ? CSW_PASSED : CSW_FAILED;

0 commit comments

Comments
 (0)