Skip to content

Commit a277db1

Browse files
maciejbocianskimergify-bot
authored andcommitted
update USBMSD::memoryRead implementation
Fix protects underlaying block device from out-of-bound reads (cherry picked from commit 89e67d3)
1 parent a0e35d2 commit a277db1

File tree

1 file changed

+13
-11
lines changed

1 file changed

+13
-11
lines changed

drivers/source/usb/USBMSD.cpp

Lines changed: 13 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -869,23 +869,25 @@ void USBMSD::memoryRead(void)
869869

870870
n = (_length > MAX_PACKET) ? MAX_PACKET : _length;
871871

872-
if ((_addr + n) > _memory_size) {
873-
n = _memory_size - _addr;
872+
if (_addr > (_memory_size - n)) {
873+
n = _addr < _memory_size ? _memory_size - _addr : 0;
874874
_stage = ERROR;
875875
}
876876

877-
// we read an entire block
878-
if (!(_addr % _block_size)) {
879-
disk_read(_page, _addr / _block_size, 1);
880-
}
877+
if (n > 0) {
878+
// we read an entire block
879+
if (!(_addr % _block_size)) {
880+
disk_read(_page, _addr / _block_size, 1);
881+
}
881882

882-
// write data which are in RAM
883-
_write_next(&_page[_addr % _block_size], MAX_PACKET);
883+
// write data which are in RAM
884+
_write_next(&_page[_addr % _block_size], MAX_PACKET);
884885

885-
_addr += n;
886-
_length -= n;
886+
_addr += n;
887+
_length -= n;
887888

888-
_csw.DataResidue -= n;
889+
_csw.DataResidue -= n;
890+
}
889891

890892
if (!_length || (_stage != PROCESS_CBW)) {
891893
_csw.Status = (_stage == PROCESS_CBW) ? CSW_PASSED : CSW_FAILED;

0 commit comments

Comments
 (0)