Menu

#9 USBHwEPWrite accesses undefined memory

open-accepted
None
5
2007-06-23
2007-05-04
Frank Buss
No

When using USBHwEPWrite to write data lengths, which are not multiples of 4 bytes (e.g. string descriptors), it is possible that undefined memory is read. Would be better to use something like in USBHwEPRead.

Discussion

  • Bertrik Sikken

    Bertrik Sikken - 2007-06-23

    Logged In: YES
    user_id=282107
    Originator: NO

    Yes, I think this is probably a bug, although a minor one.

     
  • Bertrik Sikken

    Bertrik Sikken - 2007-06-23
    • status: open --> open-accepted
     
  • Bertrik Sikken

    Bertrik Sikken - 2007-06-23
    • assigned_to: nobody --> bertrik
     
  • Nobody/Anonymous

    Logged In: NO

    I used this solution:

    int USBHwEPWrite(U8 bEP, U8 *pbBuf, int iLen)
    {
    int idx;
    int USBTxDataTemp, i;

    i = iLen;
    idx = EP2IDX(bEP);

    #ifdef DEBUG
    //DBG("-EpW-");
    #endif

    // set write enable for specific endpoint
    USBCtrl = WR_EN_BIT | ((bEP & 0xF) << 2);

    // set packet length
    USBTxPLen = iLen;

    // write data
    while (USBCtrl & WR_EN_BIT)
    {
    if (i >= 4)
    {
    USBTxData = (pbBuf[3] << 24) | (pbBuf[2] << 16) | (pbBuf[1] << 8) | pbBuf[0];
    pbBuf += 4;
    i -= 4;
    }
    else
    {
    for(USBTxDataTemp = 0; i > 0; i--)
    {
    USBTxDataTemp <<= 8;
    USBTxDataTemp |= (pbBuf[i - 1]);
    }
    USBTxData = USBTxDataTemp;
    }
    }

    // select endpoint and validate buffer

    USBHwCmd(CMD_EP_SELECT | idx);
    USBHwCmd(CMD_EP_VALIDATE_BUFFER);

    return iLen;
    }

     

Log in to post a comment.