From 6a8e27f7ee43169b9f6eb928b12e00d6306618ff Mon Sep 17 00:00:00 2001
From: Dean Camera <dean@fourwalledcubicle.com>
Date: Sat, 2 May 2009 13:05:25 +0000
Subject: Fixed Endpoint_Write_Control_* functions writing more data than
 expected by the host, causing it to panic (thanks to Johannes Raschke).

---
 LUFA/Drivers/USB/LowLevel/Endpoint.c | 61 ++++++++++++++++++++----------------
 1 file changed, 34 insertions(+), 27 deletions(-)

(limited to 'LUFA/Drivers/USB/LowLevel/Endpoint.c')

diff --git a/LUFA/Drivers/USB/LowLevel/Endpoint.c b/LUFA/Drivers/USB/LowLevel/Endpoint.c
index a872a00ff..f4f2bdc0b 100644
--- a/LUFA/Drivers/USB/LowLevel/Endpoint.c
+++ b/LUFA/Drivers/USB/LowLevel/Endpoint.c
@@ -288,9 +288,11 @@ uint8_t Endpoint_Read_Stream_BE(void* Buffer, uint16_t Length
 
 uint8_t Endpoint_Write_Control_Stream_LE(const void* Buffer, uint16_t Length)
 {
-	uint8_t* DataStream    = (uint8_t*)Buffer;
+	uint8_t* DataStream     = (uint8_t*)Buffer;
 	bool     LastPacketFull = false;
-	bool     ShortTransfer = (Length < USB_ControlRequest.wLength);
+	
+	if (Length > USB_ControlRequest.wLength)
+	  Length = USB_ControlRequest.wLength;
 	
 	while (Length && !(Endpoint_IsOUTReceived()))
 	{
@@ -309,7 +311,7 @@ uint8_t Endpoint_Write_Control_Stream_LE(const void* Buffer, uint16_t Length)
 	if (Endpoint_IsOUTReceived())
 	  return ENDPOINT_RWCSTREAM_ERROR_HostAborted;
 	
-	if (LastPacketFull || ShortTransfer)
+	if (LastPacketFull)
 	{
 		while (!(Endpoint_IsINReady()));
 		Endpoint_ClearIN();
@@ -324,26 +326,29 @@ uint8_t Endpoint_Write_Control_Stream_BE(const void* Buffer, uint16_t Length)
 {
 	uint8_t* DataStream     = (uint8_t*)(Buffer + Length - 1);
 	bool     LastPacketFull = false;
-	bool     ShortTransfer  = (Length < USB_ControlRequest.wLength);
 	
+	if (Length > USB_ControlRequest.wLength)
+	  Length = USB_ControlRequest.wLength;
+
 	while (Length && !(Endpoint_IsOUTReceived()))
 	{
-		while (!(Endpoint_IsINReady()));
-		
-		while (Length && (Endpoint_BytesInEndpoint() < USB_ControlEndpointSize))
+		if (Endpoint_IsINReady())
 		{
-			Endpoint_Write_Byte(*(DataStream--));
-			Length--;
+			while (Length && (Endpoint_BytesInEndpoint() < USB_ControlEndpointSize))
+			{
+				Endpoint_Write_Byte(*(DataStream--));
+				Length--;
+			}
+			
+			LastPacketFull = (Endpoint_BytesInEndpoint() == USB_ControlEndpointSize);
+			Endpoint_ClearIN();
 		}
-		
-		LastPacketFull = (Endpoint_BytesInEndpoint() == USB_ControlEndpointSize);
-		Endpoint_ClearIN();
 	}
 	
 	if (Endpoint_IsOUTReceived())
 	  return ENDPOINT_RWCSTREAM_ERROR_HostAborted;
 	
-	if (LastPacketFull || ShortTransfer)
+	if (LastPacketFull)
 	{
 		while (!(Endpoint_IsINReady()));
 		Endpoint_ClearIN();
@@ -360,15 +365,16 @@ uint8_t Endpoint_Read_Control_Stream_LE(void* Buffer, uint16_t Length)
 	
 	while (Length)
 	{
-		while (!(Endpoint_IsOUTReceived()));
-		
-		while (Length && Endpoint_BytesInEndpoint())
+		if (Endpoint_IsOUTReceived())
 		{
-			*(DataStream++) = Endpoint_Read_Byte();
-			Length--;
+			while (Length && Endpoint_BytesInEndpoint())
+			{
+				*(DataStream++) = Endpoint_Read_Byte();
+				Length--;
+			}
+			
+			Endpoint_ClearOUT();
 		}
-		
-		Endpoint_ClearOUT();
 	}
 	
 	while (!(Endpoint_IsINReady()));
@@ -382,15 +388,16 @@ uint8_t Endpoint_Read_Control_Stream_BE(void* Buffer, uint16_t Length)
 	
 	while (Length)
 	{
-		while (!(Endpoint_IsOUTReceived()));
-		
-		while (Length && Endpoint_BytesInEndpoint())
+		if (Endpoint_IsOUTReceived())
 		{
-			*(DataStream--) = Endpoint_Read_Byte();
-			Length--;
+			while (Length && Endpoint_BytesInEndpoint())
+			{
+				*(DataStream--) = Endpoint_Read_Byte();
+				Length--;
+			}
+			
+			Endpoint_ClearOUT();
 		}
-		
-		Endpoint_ClearOUT();
 	}
 	
 	while (!(Endpoint_IsINReady()));
-- 
cgit v1.2.3