[Libusb-win32-devel] Divide-by-zero error in driver causes BSD on Windows XP SP2

SourceForge Headquarters 1320 Columbia Street Suite 310 San Diego, CA 92101 +1 (858) 422-6466

I had to fix the code that comprises the function create_urb() in the
file transfer.c for proper handling of the packet_size parameter for
isochronous reads (see below).  Also, I added proper handling for
num_packets as well.  I had previously neglected to fill in packet_size
prior to this fix and zero was being passed in as packet_size resulting
in a divide-by-zero error in the driver and the BSD.

static NTSTATUS create_urb(libusb_device_t *dev, URB **urb, int
direction,=20
                           int urb_function, int endpoint, int
packet_size,=20
                           MDL *buffer, int size)
{
  USBD_PIPE_HANDLE pipe_handle =3D NULL;
  int num_packets =3D 0;
  int i, urb_size;

  *urb =3D NULL;
 =20
  if(!get_pipe_handle(dev, endpoint, &pipe_handle))
    {
      DEBUG_ERROR("create_urb(): getting endpoint pipe failed");
      return STATUS_INVALID_PARAMETER;
    }
 =20
  /* isochronous transfer */
  if(urb_function =3D=3D URB_FUNCTION_ISOCH_TRANSFER)
    {
      if (packet_size <=3D 0)
      {
          DEBUG_ERROR("create_urb(): invalid packet size =3D %d",
packet_size);
          return STATUS_INVALID_PARAMETER;
      }

      num_packets =3D (size + packet_size - 1) / packet_size;

      if (num_packets <=3D 0)
      {
          DEBUG_ERROR("create_urb(): invalid number of packets =3D %d",
num_packets);
          return STATUS_INVALID_PARAMETER;
      }

      if(num_packets > 255)
        {
          DEBUG_ERROR("create_urb(): transfer size too large");
          return STATUS_INVALID_PARAMETER;
        }
     =20
      urb_size =3D sizeof(struct _URB_ISOCH_TRANSFER)
        + sizeof(USBD_ISO_PACKET_DESCRIPTOR) * num_packets;
    }
  else /* bulk or interrupt transfer */
    {
      urb_size =3D sizeof(struct _URB_BULK_OR_INTERRUPT_TRANSFER);
    }
 =20
  *urb =3D ExAllocatePool(NonPagedPool, urb_size);
 =20
  if(!*urb)
    {
      DEBUG_ERROR("create_urb(): memory allocation error");
      return STATUS_NO_MEMORY;
    }
 =20
  memset(*urb, 0, urb_size);
 =20
  (*urb)->UrbHeader.Length =3D (USHORT)urb_size;
  (*urb)->UrbHeader.Function =3D (USHORT)urb_function;
 =20
  /* isochronous transfer */
  if(urb_function =3D=3D URB_FUNCTION_ISOCH_TRANSFER)
    {
      (*urb)->UrbIsochronousTransfer.PipeHandle =3D pipe_handle;
      (*urb)->UrbIsochronousTransfer.TransferFlags=20
        =3D direction | USBD_SHORT_TRANSFER_OK |
USBD_START_ISO_TRANSFER_ASAP;
      (*urb)->UrbIsochronousTransfer.TransferBufferLength =3D size;
      (*urb)->UrbIsochronousTransfer.TransferBufferMDL =3D buffer;
      (*urb)->UrbIsochronousTransfer.NumberOfPackets =3D num_packets;
     =20
      for(i =3D 0; i < num_packets; i++)
        {
          (*urb)->UrbIsochronousTransfer.IsoPacket[i].Offset =3D i *
packet_size;
          (*urb)->UrbIsochronousTransfer.IsoPacket[i].Length =3D
packet_size;
        }
    }
  /* bulk or interrupt transfer */
  else
    {
      (*urb)->UrbBulkOrInterruptTransfer.PipeHandle =3D pipe_handle;
      (*urb)->UrbBulkOrInterruptTransfer.TransferFlags=20
        =3D direction | USBD_SHORT_TRANSFER_OK;
      (*urb)->UrbBulkOrInterruptTransfer.TransferBufferLength =3D size;
      (*urb)->UrbBulkOrInterruptTransfer.TransferBufferMDL =3D buffer;
    }

  return STATUS_SUCCESS;
}

Rob Krakora
Software Engineer
Delphi Electronics & Safety
e-mail: rob...@de...
phone: 765-451-8574

-----Original Message-----
From: lib...@li...
[mailto:lib...@li...] On Behalf Of
lib...@li...
Sent: Wednesday, July 25, 2007 3:04 PM
To: lib...@li...
Subject: Libusb-win32-devel Digest, Vol 14, Issue 10

Send Libusb-win32-devel mailing list submissions to
	lib...@li...

To subscribe or unsubscribe via the World Wide Web, visit
	https://lists.sourceforge.net/lists/listinfo/libusb-win32-devel
or, via email, send a message with subject or body 'help' to
	lib...@li...

You can reach the person managing the list at
	lib...@li...

When replying, please edit your Subject line so it is more specific
than "Re: Contents of Libusb-win32-devel digest..."

Today's Topics:

   1. Not working, vista32 (Carl Kenner)

----------------------------------------------------------------------

Message: 1
Date: Wed, 25 Jul 2007 22:08:39 +0930
From: "Carl Kenner" <car...@gm...>
Subject: [Libusb-win32-devel] Not working, vista32
To: lib...@li...
Message-ID:
	<fab...@ma...>
Content-Type: text/plain; charset=3DISO-8859-1; format=3Dflowed

Installing the latest filter driver (0.1.12.1) on my vista32 laptop
gives no error, but causes HID devices in device manager to have error
39, and the test program gives version -1,-1,-1,-1 for the driver (but
gives the correct version for the dll).

Uninstalling the filter driver makes it go back to normal.

On the other hand, installing the device driver version (for the Sony
SIXAXIS) gives no error, everything looks right in device manager, and
the test program gives the right version. But it finds a single bus,
and no devices. Oh, and the inf file can't be installed by
right-clicking and choosing "install", it can only be installed with
Add New Hardware, All Devices, Have Disk.

In case you are wondering, the SIXAXIS is a HID joystick device which
doesn't describe itself correctly. It doesn't send any buttons or axis
data until you read a specific feature report, but that feature report
isn't listed as one it supports (although it does support/require it),
so trying to read that feature report in windows with HidD_GetFeature
always fails. Which is why I need libusb to work.

So... WHY isn't libusb-win32 working for me? There is, literally, zero
documentation, which doesn't help. I don't even know if it is supposed
to work on Vista.

And if you don't know how to fix the bugs in libusb-win32, do you know
of any other way to read a feature report from a USB HID device
without using HidD_GetFeature?

------------------------------

------------------------------------------------------------------------
-
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >>  http://get.splunk.com/

------------------------------

_______________________________________________
Libusb-win32-devel mailing list
Lib...@li...
https://lists.sourceforge.net/lists/listinfo/libusb-win32-devel

End of Libusb-win32-devel Digest, Vol 14, Issue 10
**************************************************

***************************************************************************=
*************

Note:  If the reader of this message is not the intended recipient, or an=
 employee or agent responsible for delivering this message to the intended=
 recipient, you are hereby notified that any dissemination, distribution or=
 copying of this communication is strictly prohibited. If you have received=
 this communication in error, please notify us immediately by replying to=
 the message and deleting it from your computer. Thank you.=20

***************************************************************************=
*************

[Libusb-win32-devel] Divide-by-zero error in driver causes BSD on Windows XP SP2

libusb-win32 is a port of libusb-0.1 under Windows

[Libusb-win32-devel] Divide-by-zero error in driver causes BSD on Windows XP SP2