diff options
| author | Dean Camera <dean@fourwalledcubicle.com> | 2016-03-28 13:41:25 +1100 |
|---|---|---|
| committer | Dean Camera <dean@fourwalledcubicle.com> | 2016-03-28 13:41:25 +1100 |
| commit | 0c9856f405ca64314fabd5e20a6b0dab4d4a776b (patch) | |
| tree | 3db6161f54cdb458b3870da45d76ab7384704667 /LUFA/Drivers | |
| parent | df16148a027bc28efc3e99baf91d1c4a35e6dbb1 (diff) | |
| download | lufa-0c9856f405ca64314fabd5e20a6b0dab4d4a776b.tar.gz lufa-0c9856f405ca64314fabd5e20a6b0dab4d4a776b.tar.bz2 lufa-0c9856f405ca64314fabd5e20a6b0dab4d4a776b.zip | |
Fixed invalid endpoint indexes causing memory corruption in device Clear/Set Feature standard requests (thanks to Peter Popovec).
Diffstat (limited to 'LUFA/Drivers')
| -rw-r--r-- | LUFA/Drivers/USB/Core/DeviceStandardReq.c | 17 |
1 files changed, 15 insertions, 2 deletions
diff --git a/LUFA/Drivers/USB/Core/DeviceStandardReq.c b/LUFA/Drivers/USB/Core/DeviceStandardReq.c index d21df8d54..e296d8d59 100644 --- a/LUFA/Drivers/USB/Core/DeviceStandardReq.c +++ b/LUFA/Drivers/USB/Core/DeviceStandardReq.c @@ -292,6 +292,7 @@ static void USB_Device_GetStatus(void) switch (USB_ControlRequest.bmRequestType) { case (REQDIR_DEVICETOHOST | REQTYPE_STANDARD | REQREC_DEVICE): + { #if !defined(NO_DEVICE_SELF_POWER) if (USB_Device_CurrentlySelfPowered) CurrentStatus |= FEATURE_SELFPOWERED_ENABLED; @@ -302,9 +303,16 @@ static void USB_Device_GetStatus(void) CurrentStatus |= FEATURE_REMOTE_WAKEUP_ENABLED; #endif break; + } case (REQDIR_DEVICETOHOST | REQTYPE_STANDARD | REQREC_ENDPOINT): + { #if !defined(CONTROL_ONLY_DEVICE) - Endpoint_SelectEndpoint((uint8_t)USB_ControlRequest.wIndex & ENDPOINT_EPNUM_MASK); + uint8_t EndpointIndex = ((uint8_t)USB_ControlRequest.wIndex & ENDPOINT_EPNUM_MASK); + + if (EndpointIndex >= ENDPOINT_TOTAL_ENDPOINTS) + return; + + Endpoint_SelectEndpoint(EndpointIndex); CurrentStatus = Endpoint_IsStalled(); @@ -312,6 +320,7 @@ static void USB_Device_GetStatus(void) #endif break; + } default: return; } @@ -330,20 +339,23 @@ static void USB_Device_ClearSetFeature(void) { #if !defined(NO_DEVICE_REMOTE_WAKEUP) case REQREC_DEVICE: + { if ((uint8_t)USB_ControlRequest.wValue == FEATURE_SEL_DeviceRemoteWakeup) USB_Device_RemoteWakeupEnabled = (USB_ControlRequest.bRequest == REQ_SetFeature); else return; break; + } #endif #if !defined(CONTROL_ONLY_DEVICE) case REQREC_ENDPOINT: + { if ((uint8_t)USB_ControlRequest.wValue == FEATURE_SEL_EndpointHalt) { uint8_t EndpointIndex = ((uint8_t)USB_ControlRequest.wIndex & ENDPOINT_EPNUM_MASK); - if (EndpointIndex == ENDPOINT_CONTROLEP) + if (EndpointIndex == ENDPOINT_CONTROLEP || EndpointIndex >= ENDPOINT_TOTAL_ENDPOINTS) return; Endpoint_SelectEndpoint(EndpointIndex); @@ -364,6 +376,7 @@ static void USB_Device_ClearSetFeature(void) } break; + } #endif default: return; |