see KSDK_1.0.0\usb\usb_core\device\sources\controller\usb_dev.c:
in usb_device_recv_data() and usb_device_send_data()
the call to get a transfer descriptor is intended to populate xd_ptr {which is dereferenced without check in usb_device_recv_data() and usb_device_send_data()}
example:
if (((usb_dev_interface_functions_struct_t*)\
usb_dev_ptr->usb_dev_interface)->dev_get_xd != NULL)
{
error = ((usb_dev_interface_functions_struct_t*)\
usb_dev_ptr->usb_dev_interface)->dev_get_xd(usb_dev_ptr->controller_handle, &xd_ptr);
}
else
{
#if _DEBUG
printf("usb_device_send_data: DEV_GET_XD is NULL\n");
#endif
return USBERR_ERROR;
}
OS_Mutex_lock(usb_dev_ptr->mutex);
/* Initialize the new transfer descriptor */
xd_ptr->ep_num = ep_num;
xd_ptr->bdirection = USB_SEND;
xd_ptr->wtotallength = size;
xd_ptr->wstartaddress = buff_ptr;
xd_ptr->wsofar = 0;
xd_ptr->bstatus = USB_STATUS_TRANSFER_ACCEPTED;
if (((usb_dev_interface_functions_struct_t*)\
usb_dev_ptr->usb_dev_interface)->dev_send != NULL)
{
error = ((usb_dev_interface_functions_struct_t*)\
usb_dev_ptr->usb_dev_interface)->dev_send(usb_dev_ptr->controller_handle, xd_ptr);
}
