Fixed possible invalid program execution when in host mode if corrupt descriptor lengths are supplied by the attached device.

Minor code cleanups to add const and reformat where missing, as well as abstract out the internal device signature start address into a macro, so that it can be altered to suit particular devices within a single architecture if needed.

Add missing documentation to the USB_Device_States_t enum.

5 files changed, 54 insertions, 21 deletions

diff --git a/LUFA/Drivers/USB/Core/AVR8/Device_AVR8.h b/LUFA/Drivers/USB/Core/AVR8/Device_AVR8.h
index f88c2f1b2..c98e17cd5 100644
--- a/LUFA/Drivers/USB/Core/AVR8/Device_AVR8.h
+++ b/LUFA/Drivers/USB/Core/AVR8/Device_AVR8.h
@@ -99,16 +99,22 @@
 				 *  On unsupported devices, this will evaluate to \ref NO_DESCRIPTOR and so will force the host to create a pseudo-serial
 				 *  number for the device.
 				 */
-				#define USE_INTERNAL_SERIAL           0xDC
+				#define USE_INTERNAL_SERIAL            0xDC
 
 				/** Length of the device's unique internal serial number, in bits, if present on the selected microcontroller
 				 *  model.
 				 */
-				#define INTERNAL_SERIAL_LENGTH_BITS   80
+				#define INTERNAL_SERIAL_LENGTH_BITS    80
+				
+				/** Start address of the internal serial number, in the appropriate address space, if present on the selected microcontroller
+				 *  model.
+				 */
+				#define INTERNAL_SERIAL_START_ADDRESS  0x0E
 			#else
-				#define USE_INTERNAL_SERIAL           NO_DESCRIPTOR
+				#define USE_INTERNAL_SERIAL            NO_DESCRIPTOR
 
-				#define INTERNAL_SERIAL_LENGTH_BITS   0
+				#define INTERNAL_SERIAL_LENGTH_BITS    0
+				#define INTERNAL_SERIAL_START_ADDRESS  0
 			#endif			
 			
 		/* Function Prototypes: */
@@ -198,12 +204,13 @@
 				return (UDADDR & (1 << ADDEN));
 			}
 		
-			static inline void USB_Device_GetSerialString(uint16_t* UnicodeString)
+			#if (USE_INTERNAL_SERIAL != NO_DESCRIPTOR)
+			static inline void USB_Device_GetSerialString(uint16_t* const UnicodeString)
 			{
 				uint_reg_t CurrentGlobalInt = GetGlobalInterruptMask();
 				GlobalInterruptDisable();
 				
-				uint8_t SigReadAddress = 0x0E;
+				uint8_t SigReadAddress = INTERNAL_SERIAL_START_ADDRESS;
 
 				for (uint8_t SerialCharNum = 0; SerialCharNum < (INTERNAL_SERIAL_LENGTH_BITS / 4); SerialCharNum++)
 				{
@@ -223,7 +230,8 @@
 				
 				SetGlobalInterruptMask(CurrentGlobalInt);
 			}
-		
+			#endif
+
 	#endif
 
 #endif
diff --git a/LUFA/Drivers/USB/Core/ConfigDescriptor.c b/LUFA/Drivers/USB/Core/ConfigDescriptor.c
index 9671659d6..a7f4d3ba0 100644
--- a/LUFA/Drivers/USB/Core/ConfigDescriptor.c
+++ b/LUFA/Drivers/USB/Core/ConfigDescriptor.c
@@ -32,8 +32,10 @@
 #include "ConfigDescriptor.h"
 
 #if defined(USB_CAN_BE_HOST)
-uint8_t USB_Host_GetDeviceConfigDescriptor(uint8_t ConfigNumber, uint16_t* const ConfigSizePtr,
-                                           void* BufferPtr, uint16_t BufferSize)
+uint8_t USB_Host_GetDeviceConfigDescriptor(const uint8_t ConfigNumber,
+                                           uint16_t* const ConfigSizePtr,
+                                           void* const BufferPtr,
+                                           const uint16_t BufferSize)
 {
 	uint8_t ErrorCode;
 	uint8_t ConfigHeader[sizeof(USB_Descriptor_Configuration_Header_t)];
@@ -114,7 +116,9 @@ void USB_GetNextDescriptorOfTypeAfter(uint16_t* const BytesRem,
 	  USB_GetNextDescriptorOfType(BytesRem, CurrConfigLoc, Type);
 }
 
-uint8_t USB_GetNextDescriptorComp(uint16_t* const BytesRem, void** const CurrConfigLoc, ConfigComparatorPtr_t const ComparatorRoutine)
+uint8_t USB_GetNextDescriptorComp(uint16_t* const BytesRem,
+                                  void** const CurrConfigLoc,
+                                  const ConfigComparatorPtr_t const ComparatorRoutine)
 {
 	uint8_t ErrorCode;
 
diff --git a/LUFA/Drivers/USB/Core/ConfigDescriptor.h b/LUFA/Drivers/USB/Core/ConfigDescriptor.h
index 54bf14dad..634dc8ff9 100644
--- a/LUFA/Drivers/USB/Core/ConfigDescriptor.h
+++ b/LUFA/Drivers/USB/Core/ConfigDescriptor.h
@@ -166,8 +166,10 @@
 			 *
 			 *  \return A value from the \ref USB_Host_GetConfigDescriptor_ErrorCodes_t enum.
 			 */
-			uint8_t USB_Host_GetDeviceConfigDescriptor(uint8_t ConfigNumber, uint16_t* const ConfigSizePtr, void* BufferPtr,
-			                                           uint16_t BufferSize) ATTR_NON_NULL_PTR_ARG(2) ATTR_NON_NULL_PTR_ARG(3);
+			uint8_t USB_Host_GetDeviceConfigDescriptor(const uint8_t ConfigNumber,
+			                                           uint16_t* const ConfigSizePtr,
+			                                           void* const BufferPtr,
+			                                           const uint16_t BufferSize) ATTR_NON_NULL_PTR_ARG(2) ATTR_NON_NULL_PTR_ARG(3);
 
 			/** Skips to the next sub-descriptor inside the configuration descriptor of the specified type value.
 			 *  The bytes remaining value is automatically decremented.
@@ -254,7 +256,7 @@
 			 */
 			uint8_t USB_GetNextDescriptorComp(uint16_t* const BytesRem,
 			                                  void** const CurrConfigLoc,
-			                                  ConfigComparatorPtr_t const ComparatorRoutine);
+			                                  const ConfigComparatorPtr_t const ComparatorRoutine);
 
 		/* Inline Functions: */
 			/** Skips over the current sub-descriptor inside the configuration descriptor, so that the pointer then
@@ -269,8 +271,11 @@
 			                                         void** CurrConfigLoc)
 			{
 				uint16_t CurrDescriptorSize = DESCRIPTOR_CAST(*CurrConfigLoc, USB_Descriptor_Header_t).Size;
+				
+				if (*BytesRem < CurrDescriptorSize)
+				  CurrDescriptorSize = *BytesRem;
 
-				*CurrConfigLoc  = ((uint8_t*)*CurrConfigLoc) + CurrDescriptorSize;
+				*CurrConfigLoc  = (void*)((uintptr_t)*CurrConfigLoc + CurrDescriptorSize);
 				*BytesRem      -= CurrDescriptorSize;
 			}
 
diff --git a/LUFA/Drivers/USB/Core/Device.h b/LUFA/Drivers/USB/Core/Device.h
index be3dfd118..0e8662417 100644
--- a/LUFA/Drivers/USB/Core/Device.h
+++ b/LUFA/Drivers/USB/Core/Device.h
@@ -63,6 +63,13 @@
 

 	/* Public Interface - May be used in end-application: */

 		/* Enums: */

+			/** Enum for the various states of the USB Device state machine. Only some states are

+			 *  implemented in the LUFA library - other states are left to the user to implement.

+			 *

+			 *  For information on each possible USB device state, refer to the USB 2.0 specification.

+			 *

+			 *  \see \ref USB_DeviceState, which stores the current device state machine state.

+			 */

 			enum USB_Device_States_t

 			{

 				DEVICE_STATE_Unattached                   = 0, /**< Internally implemented by the library. This state indicates

diff --git a/LUFA/Drivers/USB/Core/UC3/Device_UC3.h b/LUFA/Drivers/USB/Core/UC3/Device_UC3.h
index ed7409856..8bc8188d2 100644
--- a/LUFA/Drivers/USB/Core/UC3/Device_UC3.h
+++ b/LUFA/Drivers/USB/Core/UC3/Device_UC3.h
@@ -89,18 +89,24 @@
 				 *  On unsupported devices, this will evaluate to \ref NO_DESCRIPTOR and so will force the host to create a pseudo-serial

 				 *  number for the device.

 				 */

-				#define USE_INTERNAL_SERIAL           0xDC

+				#define USE_INTERNAL_SERIAL             0xDC

 				

 				/** Length of the device's unique internal serial number, in bits, if present on the selected microcontroller

 				 *  model.

 				 */

-				#define INTERNAL_SERIAL_LENGTH_BITS   120

+				#define INTERNAL_SERIAL_LENGTH_BITS     120

+

+				/** Start address of the internal serial number, in the appropriate address space, if present on the selected microcontroller

+				 *  model.

+				 */

+				#define INTERNAL_SERIAL_START_ADDRESS   0x80800204

 			#else

-				#define USE_INTERNAL_SERIAL           NO_DESCRIPTOR

+				#define USE_INTERNAL_SERIAL             NO_DESCRIPTOR

 

-				#define INTERNAL_SERIAL_LENGTH_BITS   0

+				#define INTERNAL_SERIAL_LENGTH_BITS     0

+				#define INTERNAL_SERIAL_START_ADDRESS   0

 			#endif

-			

+						

 		/* Function Prototypes: */

 			/** Sends a Remote Wakeup request to the host. This signals to the host that the device should

 			 *  be taken out of suspended mode, and communications should resume.

@@ -186,12 +192,13 @@
 				return AVR32_USBB.UDCON.adden;

 			}

 

-			static inline void USB_Device_GetSerialString(uint16_t* UnicodeString)

+			#if (USE_INTERNAL_SERIAL != NO_DESCRIPTOR)

+			static inline void USB_Device_GetSerialString(uint16_t* const UnicodeString)

 			{

 				uint_reg_t CurrentGlobalInt = GetGlobalInterruptMask();

 				GlobalInterruptDisable();

 				

-				uint8_t* SigReadAddress = (uint8_t*)0x80800204;

+				uint8_t* SigReadAddress = (uint8_t*)INTERNAL_SERIAL_START_ADDRESS;

 

 				for (uint8_t SerialCharNum = 0; SerialCharNum < (INTERNAL_SERIAL_LENGTH_BITS / 4); SerialCharNum++)

 				{

@@ -211,6 +218,8 @@
 				

 				SetGlobalInterruptMask(CurrentGlobalInt);

 			}

+			#endif

+

 	#endif

 

 #endif