Fix overflow for RNDIS class driver responses when returning the adapter query list (thanks to Peter Mc Shane).

4 files changed, 14 insertions, 11 deletions

diff --git a/Demos/Device/ClassDriver/RNDISEthernet/Lib/DHCP.c b/Demos/Device/ClassDriver/RNDISEthernet/Lib/DHCP.c
index a72a6ce3f..b3b5d6943 100644
--- a/Demos/Device/ClassDriver/RNDISEthernet/Lib/DHCP.c
+++ b/Demos/Device/ClassDriver/RNDISEthernet/Lib/DHCP.c
@@ -54,8 +54,8 @@ int16_t DHCP_ProcessDHCPPacket(void* IPHeaderInStart,
 	DHCP_Header_t* DHCPHeaderIN  = (DHCP_Header_t*)DHCPHeaderInStart;
 	DHCP_Header_t* DHCPHeaderOUT = (DHCP_Header_t*)DHCPHeaderOutStart;
 
-	uint8_t* DHCPOptionsINStart  = (uint8_t*)(DHCPHeaderInStart  + sizeof(DHCP_Header_t));
-	uint8_t* DHCPOptionsOUTStart = (uint8_t*)(DHCPHeaderOutStart + sizeof(DHCP_Header_t));
+	uint8_t* DHCPOptionsINStart  = ((uint8_t*)DHCPHeaderInStart  + sizeof(DHCP_Header_t));
+	uint8_t* DHCPOptionsOUTStart = ((uint8_t*)DHCPHeaderOutStart + sizeof(DHCP_Header_t));
 
 	DecodeDHCPHeader(DHCPHeaderInStart);
 
diff --git a/Demos/Device/ClassDriver/RNDISEthernet/Lib/Webserver.h b/Demos/Device/ClassDriver/RNDISEthernet/Lib/Webserver.h
index 8307d46da..142dc7a03 100644
--- a/Demos/Device/ClassDriver/RNDISEthernet/Lib/Webserver.h
+++ b/Demos/Device/ClassDriver/RNDISEthernet/Lib/Webserver.h
@@ -46,7 +46,7 @@
 
 	/* Macros: */
 		/** Maximum size of a HTTP response per transmission */
-		#define  HTTP_REPLY_BLOCK_SIZE     128
+		#define HTTP_REPLY_BLOCK_SIZE     128
 
 	/* Function Prototypes: */
 		void Webserver_Init(void);
diff --git a/Demos/Device/ClassDriver/RNDISEthernet/RNDISEthernet.c b/Demos/Device/ClassDriver/RNDISEthernet/RNDISEthernet.c
index 95d93549e..bdb506117 100644
--- a/Demos/Device/ClassDriver/RNDISEthernet/RNDISEthernet.c
+++ b/Demos/Device/ClassDriver/RNDISEthernet/RNDISEthernet.c
@@ -36,6 +36,15 @@
 
 #include "RNDISEthernet.h"
 
+/** Message buffer for RNDIS messages processed by the RNDIS device class driver. */
+static uint8_t RNDIS_Message_Buffer[192];
+
+/** Global to store the incoming frame from the host before it is processed by the device. */
+static Ethernet_Frame_Info_t FrameIN;
+
+/** Global to store the outgoing frame created in the device before it is sent to the host. */
+static Ethernet_Frame_Info_t FrameOUT;
+
 /** LUFA RNDIS Class driver interface configuration and state information. This structure is
  *  passed to all RNDIS Class driver functions, so that multiple instances of the same class
  *  within a device can be differentiated from one another.
@@ -65,14 +74,11 @@ USB_ClassInfo_RNDIS_Device_t Ethernet_RNDIS_Interface =
 					},
 				.AdapterVendorDescription       = "LUFA RNDIS Demo Adapter",
 				.AdapterMACAddress              = {ADAPTER_MAC_ADDRESS},
+				.MessageBuffer                  = RNDIS_Message_Buffer,
+				.MessageBufferLength            = sizeof(RNDIS_Message_Buffer),
 			},
 	};
 
-/** Global to store the incoming frame from the host before it is processed by the device. */
-static Ethernet_Frame_Info_t FrameIN;
-
-/** Global to store the outgoing frame created in the device before it is sent to the host. */
-static Ethernet_Frame_Info_t FrameOUT;
 
 /** Main program entry point. This routine contains the overall program flow, including initial
  *  setup of all components and the main program loop.
diff --git a/Demos/Device/LowLevel/RNDISEthernet/RNDISEthernet.h b/Demos/Device/LowLevel/RNDISEthernet/RNDISEthernet.h
index d01b3cb23..90fbae335 100644
--- a/Demos/Device/LowLevel/RNDISEthernet/RNDISEthernet.h
+++ b/Demos/Device/LowLevel/RNDISEthernet/RNDISEthernet.h
@@ -58,9 +58,6 @@
 		#include <LUFA/Platform/Platform.h>
 
 	/* Macros: */
-		/** Notification value to indicate that a frame is ready to be read by the host. */
-		#define NOTIF_RESPONSE_AVAILABLE  0x01
-
 		/** LED mask for the library LED driver, to indicate that the USB interface is not ready. */
 		#define LEDMASK_USB_NOTREADY      LEDS_LED1