@@ -49,6 +49,7 @@ void tuh_umount_cb(uint8_t dev_addr) {
4949}
5050
5151STATIC xfer_result_t _xfer_result ;
52+ STATIC size_t _actual_len ;
5253bool common_hal_usb_core_device_construct (usb_core_device_obj_t * self , uint8_t device_number ) {
5354 if (device_number == 0 || device_number > CFG_TUH_DEVICE_MAX + CFG_TUH_HUB ) {
5455 return false;
@@ -78,6 +79,9 @@ uint16_t common_hal_usb_core_device_get_idProduct(usb_core_device_obj_t *self) {
7879STATIC void _transfer_done_cb (tuh_xfer_t * xfer ) {
7980 // Store the result so we stop waiting for the transfer.
8081 _xfer_result = xfer -> result ;
82+ // The passed in xfer is not the original one we passed in, so we need to
83+ // copy any info out that we want (like actual_len.)
84+ _actual_len = xfer -> actual_len ;
8185}
8286
8387STATIC bool _wait_for_callback (void ) {
@@ -159,11 +163,14 @@ STATIC size_t _xfer(tuh_xfer_t *xfer, mp_int_t timeout) {
159163 }
160164 xfer_result_t result = _xfer_result ;
161165 _xfer_result = 0xff ;
162- if (result == XFER_RESULT_STALLED || result == 0xff ) {
166+ if (result == XFER_RESULT_STALLED ) {
167+ mp_raise_usb_core_USBError (translate ("Pipe error" ));
168+ }
169+ if (result == 0xff ) {
163170 mp_raise_usb_core_USBTimeoutError ();
164171 }
165172 if (result == XFER_RESULT_SUCCESS ) {
166- return xfer -> actual_len ;
173+ return _actual_len ;
167174 }
168175
169176 return 0 ;
@@ -192,7 +199,10 @@ STATIC bool _open_endpoint(usb_core_device_obj_t *self, mp_int_t endpoint) {
192199 }
193200 tusb_desc_configuration_t * desc_cfg = (tusb_desc_configuration_t * )desc_buf ;
194201
195- uint8_t const * desc_end = ((uint8_t const * )desc_cfg ) + tu_le16toh (desc_cfg -> wTotalLength );
202+ uint32_t total_length = tu_le16toh (desc_cfg -> wTotalLength );
203+ // Cap to the buffer size we requested.
204+ total_length = MIN (total_length , sizeof (desc_buf ));
205+ uint8_t const * desc_end = ((uint8_t const * )desc_cfg ) + total_length ;
196206 uint8_t const * p_desc = tu_desc_next (desc_cfg );
197207
198208 // parse each interfaces
@@ -281,7 +291,10 @@ mp_int_t common_hal_usb_core_device_ctrl_transfer(usb_core_device_obj_t *self,
281291 }
282292 xfer_result_t result = _xfer_result ;
283293 _xfer_result = 0xff ;
284- if (result == XFER_RESULT_STALLED || result == 0xff ) {
294+ if (result == XFER_RESULT_STALLED ) {
295+ mp_raise_usb_core_USBError (translate ("Pipe error" ));
296+ }
297+ if (result == 0xff ) {
285298 mp_raise_usb_core_USBTimeoutError ();
286299 }
287300 if (result == XFER_RESULT_SUCCESS ) {
0 commit comments