Merge pull request #3042 from rppicomidi/fix_3033

Fix #3033: Increase array bounds and test for overflow

Author: hathach

src/class/midi/midi_host.c

@@ -254,7 +254,9 @@ bool midih_open(uint8_t rhport, uint8_t dev_addr, tusb_desc_interface_t const *d
             TU_LOG_DRV("  Jack %s %s descriptor \r\n",
                        tu_desc_subtype(p_desc) == MIDI_CS_INTERFACE_IN_JACK ? "IN" : "OUT",
                        p_desc[3] == MIDI_JACK_EXTERNAL ? "External" : "Embedded");
-            desc_cb.desc_jack[desc_cb.jack_num++] = p_desc;
+            if (desc_cb.jack_num < TU_ARRAY_SIZE(desc_cb.desc_jack)) {
+                desc_cb.desc_jack[desc_cb.jack_num++] = p_desc;
+            }
             break;
           }
 
@@ -590,8 +592,8 @@ uint32_t tuh_midi_stream_read(uint8_t idx, uint8_t *p_cable_num, uint8_t *p_buff
             break;
           default:
             break;
-            cable_sysex_in_progress &= (uint16_t) ~cable_mask;
         }
+        cable_sysex_in_progress &= (uint16_t) ~cable_mask;
       } else {
         // Real-time message: can be inserted into a sysex message,
         // so do don't clear cable_sysex_in_progress bit

src/class/midi/midi_host.h

@@ -69,7 +69,7 @@ typedef struct {
   const tusb_desc_endpoint_t* desc_epout; // endpoint OUT descriptor, CS_ENDPOINT is right after
 
   uint8_t jack_num;
-  const uint8_t* desc_jack[16]; // list of jack descriptors (embedded + external)
+  const uint8_t* desc_jack[32]; // list of jack descriptors (embedded + external)
 } tuh_midi_descriptor_cb_t;
 
 typedef struct {