AnsweredAssumed Answered

BUG? usb ksdk 1.0.0 dev_get_xd response not checked

Question asked by Chris Charleson on Oct 9, 2014
Latest reply on Oct 14, 2014 by Jorge_Gonzalez

see KSDK_1.0.0\usb\usb_core\device\sources\controller\usb_dev.c:

in usb_device_recv_data() and usb_device_send_data()

 

the call to get a transfer descriptor is intended to populate xd_ptr {which is dereferenced without check in usb_device_recv_data() and usb_device_send_data()}

 

example:

    if (((usb_dev_interface_functions_struct_t*)\

        usb_dev_ptr->usb_dev_interface)->dev_get_xd != NULL)

    {

        error = ((usb_dev_interface_functions_struct_t*)\

            usb_dev_ptr->usb_dev_interface)->dev_get_xd(usb_dev_ptr->controller_handle, &xd_ptr);   

    }

    else

    {

        #if _DEBUG

            printf("usb_device_send_data: DEV_GET_XD is NULL\n");

        #endif 

        return USBERR_ERROR;

    }

   

    OS_Mutex_lock(usb_dev_ptr->mutex);

 

 

    /* Initialize the new transfer descriptor */     

    xd_ptr->ep_num = ep_num;

    xd_ptr->bdirection = USB_SEND;

    xd_ptr->wtotallength = size;

    xd_ptr->wstartaddress = buff_ptr;

    xd_ptr->wsofar = 0;

    xd_ptr->bstatus = USB_STATUS_TRANSFER_ACCEPTED;

   

    if (((usb_dev_interface_functions_struct_t*)\

        usb_dev_ptr->usb_dev_interface)->dev_send != NULL)

    {

        error = ((usb_dev_interface_functions_struct_t*)\

            usb_dev_ptr->usb_dev_interface)->dev_send(usb_dev_ptr->controller_handle, xd_ptr);   

    }

Outcomes