michaelh/zephyr
1
0
Fork 0
Code Releases Activity

usb: dc: native_posix: Fix Coverity bug

Browse source 
Fixes Untrusted array index read bug.

Fixes #14406

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
This commit is contained in:
Andrei Emeltchenko 2019-03-13 10:41:01 +02:00 • committed by Kumar Gala
commit f8e1dfc331
1 changed files with 8 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

8
drivers/usb/device/usb_dc_native_posix.c
View file

@ -515,6 +515,10 @@ int handle_usb_data(struct usbip_header *hdr)
LOG_DBG("ep_idx %u", ep_idx); LOG_DBG("ep_idx %u", ep_idx);
if (ntohl(hdr->common.direction) == USBIP_DIR_OUT) { if (ntohl(hdr->common.direction) == USBIP_DIR_OUT) {
if (ep_idx >= USBIP_OUT_EP_NUM) {
return -EINVAL;
}
ep = ep_idx | USB_EP_DIR_OUT; ep = ep_idx | USB_EP_DIR_OUT;
ep_cb = usbip_ctrl.out_ep_ctrl[ep_idx].cb; ep_cb = usbip_ctrl.out_ep_ctrl[ep_idx].cb;
@ -523,6 +527,10 @@ int handle_usb_data(struct usbip_header *hdr)
/* Send ACK reply */ /* Send ACK reply */
bytes = usbip_send_common(ep, 0); bytes = usbip_send_common(ep, 0);
} else { } else {
if (ep_idx >= USBIP_IN_EP_NUM) {
return -EINVAL;
}
ep = ep_idx | USB_EP_DIR_IN; ep = ep_idx | USB_EP_DIR_IN;
ep_cb = usbip_ctrl.in_ep_ctrl[ep_idx].cb; ep_cb = usbip_ctrl.in_ep_ctrl[ep_idx].cb;