From a9ffd7282525bfe771b156f3ea8c56ab25939f6e Mon Sep 17 00:00:00 2001 From: Rutherther Date: Sat, 26 Oct 2024 17:55:21 +0200 Subject: [PATCH] fix: make sure to error if endpoint id not found in interrupt This generally shouldn't happen, but it needs to be ensured that the memory at incorrect place won't be read or written to! Otherwise there could be undefined behavior! This would possibly write to the fifos, meaning the data the usb sends could be different than what the application intended! --- src/usb_device.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/src/usb_device.c b/src/usb_device.c index fe36d76..de88603 100644 --- a/src/usb_device.c +++ b/src/usb_device.c @@ -392,6 +392,12 @@ uint8_t usb_daint_get_endpoint_number(uint32_t endpoints) { void usb_handle_endpoint_in_int(usb_device_t* device) { uint8_t ep_id = usb_daint_get_endpoint_number(reg_read_bits_pos(&device->device->DAINT, USB_OTG_DAINT_IEPINT_Pos, 0xFFFF)); + + if (ep_id == 0xFF) { + device->state = ERROR; + return; + } + uint32_t interrupt_reg = device->in[ep_id].DIEPINT; if (interrupt_reg & USB_OTG_DIEPINT_PKTDRPSTS) { @@ -447,6 +453,12 @@ void usb_handle_endpoint_out_int(usb_device_t* device) { /* device->core->GRXFSIZ; */ uint8_t ep_id = usb_daint_get_endpoint_number(reg_read_bits_pos(&device->device->DAINT, USB_OTG_DAINT_OEPINT_Pos, 0xFFFF)); + + if (ep_id == 0xFF) { + device->state = ERROR; + return; + } + uint32_t interrupt_reg = device->out[ep_id].DOEPINT; if (interrupt_reg & USB_OTG_DOEPINT_STPKTRX) { -- 2.48.1