forksand
/
qmk_firmware
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Fixed possible invalid program execution when in host mode if corrupt descriptor lengths are supplied by the attached device.

Browse Source 
Minor code cleanups to add const and reformat where missing, as well as abstract out the internal device signature start address into a macro, so that it can be altered to suit particular devices within a single architecture if needed.

Add missing documentation to the USB_Device_States_t enum.
pull/1469/head
Dean Camera 13 years ago
parent 78e58b6d1c
commit 049e930963
11 changed files with 66 additions and 27 deletions
Show Stats Download Patch File Download Diff File

2
Demos/Host/Incomplete/AndroidAccessoryHost/ConfigDescriptor.c
Unescape View File

@ -90,7 +90,7 @@ uint8_t ProcessConfigurationDescriptor(void)
/* If the endpoint is a IN type endpoint */
if (EndpointData->EndpointAddress & ENDPOINT_DESCRIPTOR_DIR_IN)
DataINEndpoint = EndpointData;
DataINEndpoint = EndpointData;
else
DataOUTEndpoint = EndpointData;
}

2
LUFA.pnproj
View File

File diff suppressed because one or more lines are too long

2
LUFA/Drivers/USB/Class/Common/HIDParser.c
Unescape View File

@ -351,7 +351,7 @@ uint16_t USB_GetHIDReportSize(HID_ReportInfo_t* const ParserData,
uint16_t ReportSizeBits = ParserData->ReportIDSizes[i].ReportSizeBits[ReportType];
if (ParserData->ReportIDSizes[i].ReportID == ReportID)
return ((ReportSizeBits >> 3) + ((ReportSizeBits & 0x07) ? 1 : 0));
return (ReportSizeBits / 8) + ((ReportSizeBits % 8) ? 1 : 0);
}
return 0;

22
LUFA/Drivers/USB/Core/AVR8/Device_AVR8.h
Unescape View File

@ -99,16 +99,22 @@
* On unsupported devices, this will evaluate to \ref NO_DESCRIPTOR and so will force the host to create a pseudo-serial
* number for the device.
*/
#define USE_INTERNAL_SERIAL 0xDC
#define USE_INTERNAL_SERIAL 0xDC
/** Length of the device's unique internal serial number, in bits, if present on the selected microcontroller
* model.
*/
#define INTERNAL_SERIAL_LENGTH_BITS 80
#define INTERNAL_SERIAL_LENGTH_BITS 80
/** Start address of the internal serial number, in the appropriate address space, if present on the selected microcontroller
* model.
*/
#define INTERNAL_SERIAL_START_ADDRESS 0x0E
#else
#define USE_INTERNAL_SERIAL NO_DESCRIPTOR
#define USE_INTERNAL_SERIAL NO_DESCRIPTOR
#define INTERNAL_SERIAL_LENGTH_BITS 0
#define INTERNAL_SERIAL_LENGTH_BITS 0
#define INTERNAL_SERIAL_START_ADDRESS 0
#endif
/* Function Prototypes: */
@ -198,12 +204,13 @@
return (UDADDR & (1 << ADDEN));
}
static inline void USB_Device_GetSerialString(uint16_t* UnicodeString)
#if (USE_INTERNAL_SERIAL != NO_DESCRIPTOR)
static inline void USB_Device_GetSerialString(uint16_t* const UnicodeString)
{
uint_reg_t CurrentGlobalInt = GetGlobalInterruptMask();
GlobalInterruptDisable();
uint8_t SigReadAddress = 0x0E;
uint8_t SigReadAddress = INTERNAL_SERIAL_START_ADDRESS;
for (uint8_t SerialCharNum = 0; SerialCharNum < (INTERNAL_SERIAL_LENGTH_BITS / 4); SerialCharNum++)
{
@ -223,7 +230,8 @@
SetGlobalInterruptMask(CurrentGlobalInt);
}
#endif
#endif
#endif

10
LUFA/Drivers/USB/Core/ConfigDescriptor.c
Unescape View File

@ -32,8 +32,10 @@
#include "ConfigDescriptor.h"
#if defined(USB_CAN_BE_HOST)
uint8_t USB_Host_GetDeviceConfigDescriptor(uint8_t ConfigNumber, uint16_t* const ConfigSizePtr,
void* BufferPtr, uint16_t BufferSize)
uint8_t USB_Host_GetDeviceConfigDescriptor(const uint8_t ConfigNumber,
uint16_t* const ConfigSizePtr,
void* const BufferPtr,
const uint16_t BufferSize)
{
uint8_t ErrorCode;
uint8_t ConfigHeader[sizeof(USB_Descriptor_Configuration_Header_t)];
@ -114,7 +116,9 @@ void USB_GetNextDescriptorOfTypeAfter(uint16_t* const BytesRem,
USB_GetNextDescriptorOfType(BytesRem, CurrConfigLoc, Type);
}
uint8_t USB_GetNextDescriptorComp(uint16_t* const BytesRem, void** const CurrConfigLoc, ConfigComparatorPtr_t const ComparatorRoutine)
uint8_t USB_GetNextDescriptorComp(uint16_t* const BytesRem,
void** const CurrConfigLoc,
const ConfigComparatorPtr_t const ComparatorRoutine)
{
uint8_t ErrorCode;

13
LUFA/Drivers/USB/Core/ConfigDescriptor.h
Unescape View File

@ -166,8 +166,10 @@
*
* \return A value from the \ref USB_Host_GetConfigDescriptor_ErrorCodes_t enum.
*/
uint8_t USB_Host_GetDeviceConfigDescriptor(uint8_t ConfigNumber, uint16_t* const ConfigSizePtr, void* BufferPtr,
uint16_t BufferSize) ATTR_NON_NULL_PTR_ARG(2) ATTR_NON_NULL_PTR_ARG(3);
uint8_t USB_Host_GetDeviceConfigDescriptor(const uint8_t ConfigNumber,
uint16_t* const ConfigSizePtr,
void* const BufferPtr,
const uint16_t BufferSize) ATTR_NON_NULL_PTR_ARG(2) ATTR_NON_NULL_PTR_ARG(3);
/** Skips to the next sub-descriptor inside the configuration descriptor of the specified type value.
* The bytes remaining value is automatically decremented.
@ -254,7 +256,7 @@
*/
uint8_t USB_GetNextDescriptorComp(uint16_t* const BytesRem,
void** const CurrConfigLoc,
ConfigComparatorPtr_t const ComparatorRoutine);
const ConfigComparatorPtr_t const ComparatorRoutine);
/* Inline Functions: */
/** Skips over the current sub-descriptor inside the configuration descriptor, so that the pointer then
@ -269,8 +271,11 @@
void** CurrConfigLoc)
{
uint16_t CurrDescriptorSize = DESCRIPTOR_CAST(*CurrConfigLoc, USB_Descriptor_Header_t).Size;
if (*BytesRem < CurrDescriptorSize)
CurrDescriptorSize = *BytesRem;
*CurrConfigLoc = ((uint8_t*)*CurrConfigLoc) + CurrDescriptorSize;
*CurrConfigLoc = (void*)((uintptr_t)*CurrConfigLoc + CurrDescriptorSize);
*BytesRem -= CurrDescriptorSize;
}

7
LUFA/Drivers/USB/Core/Device.h
Unescape View File

@ -63,6 +63,13 @@
/* Public Interface - May be used in end-application: */
/* Enums: */
/** Enum for the various states of the USB Device state machine. Only some states are
* implemented in the LUFA library - other states are left to the user to implement.
*
* For information on each possible USB device state, refer to the USB 2.0 specification.
*
* \see \ref USB_DeviceState, which stores the current device state machine state.
*/
enum USB_Device_States_t
{
DEVICE_STATE_Unattached = 0, /**< Internally implemented by the library. This state indicates

23
LUFA/Drivers/USB/Core/UC3/Device_UC3.h
Unescape View File

@ -89,18 +89,24 @@
* On unsupported devices, this will evaluate to \ref NO_DESCRIPTOR and so will force the host to create a pseudo-serial
* number for the device.
*/
#define USE_INTERNAL_SERIAL 0xDC
#define USE_INTERNAL_SERIAL 0xDC
/** Length of the device's unique internal serial number, in bits, if present on the selected microcontroller
* model.
*/
#define INTERNAL_SERIAL_LENGTH_BITS 120
#define INTERNAL_SERIAL_LENGTH_BITS 120
/** Start address of the internal serial number, in the appropriate address space, if present on the selected microcontroller
* model.
*/
#define INTERNAL_SERIAL_START_ADDRESS 0x80800204
#else
#define USE_INTERNAL_SERIAL NO_DESCRIPTOR
#define USE_INTERNAL_SERIAL NO_DESCRIPTOR
#define INTERNAL_SERIAL_LENGTH_BITS 0
#define INTERNAL_SERIAL_LENGTH_BITS 0
#define INTERNAL_SERIAL_START_ADDRESS 0
#endif
/* Function Prototypes: */
/** Sends a Remote Wakeup request to the host. This signals to the host that the device should
* be taken out of suspended mode, and communications should resume.
@ -186,12 +192,13 @@
return AVR32_USBB.UDCON.adden;
}
static inline void USB_Device_GetSerialString(uint16_t* UnicodeString)
#if (USE_INTERNAL_SERIAL != NO_DESCRIPTOR)
static inline void USB_Device_GetSerialString(uint16_t* const UnicodeString)
{
uint_reg_t CurrentGlobalInt = GetGlobalInterruptMask();
GlobalInterruptDisable();
uint8_t* SigReadAddress = (uint8_t*)0x80800204;
uint8_t* SigReadAddress = (uint8_t*)INTERNAL_SERIAL_START_ADDRESS;
for (uint8_t SerialCharNum = 0; SerialCharNum < (INTERNAL_SERIAL_LENGTH_BITS / 4); SerialCharNum++)
{
@ -211,6 +218,8 @@
SetGlobalInterruptMask(CurrentGlobalInt);
}
#endif
#endif
#endif

2
LUFA/ManPages/ChangeLog.txt
Unescape View File

@ -36,6 +36,7 @@
* - Added new VirtualSerialMassStorage Device ClassDriver demo
* - Added HID class bootloader, compatible with a modified version of the command line Teensy loader from PJRC.com
* - Added LED flashing to the CDC and DFU class bootloaders to indicate when they are running
* - Added new incomplete AndroidAccessoryHost Host LowLevel demo
*
* <b>Changed:</b>
* - Core:
@ -99,6 +100,7 @@
* is found
* - Fixed missing call to Pipe_SetInfiniteINRequests() in the Pipe_ConfigurePipe() routine
* - Fixed Remote Wakeup broken on the AVRs due to the mechanism only operating when the SUSPI bit is set (thanks to Holger Steinhaus)
* - Fixed possible invalid program execution when in host mode if corrupt descriptor lengths are supplied by the attached device
* - Library Applications:
* - Fixed Benito project discarding incoming data from the USB virtual serial port when the USART is busy
* - Fixed broken DFU bootloader, added XPLAIN support for bootloader start when XCK jumpered to ground

1
LUFA/ManPages/FutureChanges.txt
Unescape View File

@ -20,6 +20,7 @@
* -# Add makefile includes to reduce boilerplate in user makefiles
* -# Update stream APIs to use DMA transfers on supported architectures
* -# Pull out third party libraries into a seperate folder and reference them as required
* -# Add a LUFA_YIELD macro for integration into a third-party RTOS
* - Documentation/Support
* -# Add detailed overviews of how each demo works
* -# Add board overviews

9
LUFA/makefile
Unescape View File

@ -58,9 +58,12 @@ LUFA_SRC_SCHEDULER = $(LUFA_ROOT_PATH)/Scheduler/Scheduler.c
# Check to see if the LUFA_PATH variable has not been set (the makefile is not being included from a project makefile)
ifeq ($(origin LUFA_PATH), undefined)
LUFA_SRC_ALL_FILES = $(LUFA_SRC_USB) $(LUFA_SRC_USBCLASS) \
$(LUFA_SRC_TEMPERATURE) $(LUFA_SRC_SERIAL) \
$(LUFA_SRC_TWI) $(LUFA_SRC_SCHEDULER)
LUFA_SRC_ALL_FILES = $(LUFA_SRC_USB) \
$(LUFA_SRC_USBCLASS) \
$(LUFA_SRC_TEMPERATURE) \
$(LUFA_SRC_SERIAL) \
$(LUFA_SRC_TWI) \
$(LUFA_SRC_SCHEDULER)
all:

Write Preview
Loading…
Cancel
Save