Skip to content

Commit 453ba52

Browse files
authored
OHCI: Fix array out of bounds issue
If using a USB hub, a request outside the array size can occur Original line: https://github.com/hathach/tinyusb/blob/ffb257ac17f162bc5a4c26596d7a1e954db98aa5/src/portable/ohci/ohci.h#L162 It can happen in a few places but one such example is here: https://github.com/hathach/tinyusb/blob/ffb257ac17f162bc5a4c26596d7a1e954db98aa5/src/portable/ohci/ohci.c#L460 ie. if HUB address is 5, this would be an array index out of bounds on control endpoints as `CFG_TUH_DEVICE_MAX+1` is only 5. This fix just includes num of hubs in the reserve array size. Fixing locally fixed this issue.
1 parent ffb257a commit 453ba52

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

src/portable/ohci/ohci.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -159,7 +159,7 @@ typedef struct TU_ATTR_ALIGNED(256)
159159
struct {
160160
ohci_ed_t ed;
161161
ohci_gtd_t gtd;
162-
}control[CFG_TUH_DEVICE_MAX+1];
162+
}control[CFG_TUH_DEVICE_MAX+CFG_TUH_HUB+1];
163163

164164
// ochi_itd_t itd[OHCI_MAX_ITD]; // itd requires alignment of 32
165165
ohci_ed_t ed_pool[HCD_MAX_ENDPOINT];

0 commit comments

Comments
 (0)