[prev in list] [next in list] [prev in thread] [next in thread] 

List:       libusb-devel
Subject:    [Libusb-devel] [PATCH] fixed trac #68 (incorrect buffer size for
From:       Pete Batard <pbatard () gmail ! com>
Date:       2011-01-27 22:23:23
Message-ID: 4D41F05B.1040405 () gmail ! com
[Download RAW message or body]

Should apply cleanly on current -stuge (after the 2 previous warning 
patches)

Regards,

/Pete

 From f532423e783f9631bdefbb3d30549c23d306f2c7 Mon Sep 17 00:00:00 2001
From: Pete Batard <pbatard@gmail.com>
Date: Thu, 27 Jan 2011 22:15:03 +0000
Subject: [PATCH] fixed trac #68 (incorrect buffer size for HID reports)

* reported by gorlik
---
  libusb/os/windows_usb.c |   17 ++++++-----------
  1 files changed, 6 insertions(+), 11 deletions(-)

diff --git a/libusb/os/windows_usb.c b/libusb/os/windows_usb.c
index dc0d0ae..e2d6b35 100644
--- a/libusb/os/windows_usb.c
+++ b/libusb/os/windows_usb.c
@@ -3257,11 +3257,6 @@ static int _hid_get_report(struct 
hid_device_priv* dev, HANDLE hid_handle, int i
  			return LIBUSB_ERROR_INVALID_PARAM;
  	}

-	// When report IDs are not in use, add an extra byte for the report ID
-	if (id==0) {
-		expected_size++;
-	}
-
  	// Add a trailing byte to detect overflows
  	buf = (uint8_t*)calloc(expected_size+1, 1);
  	if (buf == NULL) {
@@ -3271,7 +3266,9 @@ static int _hid_get_report(struct hid_device_priv* 
dev, HANDLE hid_handle, int i
  	usbi_dbg("report ID: 0x%02X", buf[0]);

  	tp->hid_expected_size = expected_size;
+	read_size = expected_size;

+	// NB: The size returned by DeviceIoControl doesn't include report IDs 
when not in use (0)
  	if (!DeviceIoControl(hid_handle, ioctl_code, buf, expected_size+1,
  		buf, expected_size+1, &read_size, overlapped)) {
  		if (GetLastError() != ERROR_IO_PENDING) {
@@ -3287,7 +3284,7 @@ static int _hid_get_report(struct hid_device_priv* 
dev, HANDLE hid_handle, int i

  	// Transfer completed synchronously => copy and discard extra buffer
  	if (read_size == 0) {
-		usbi_dbg("program assertion failed - read completed synchronously, 
but no data was read");
+		usbi_warn(NULL, "program assertion failed - read completed 
synchronously, but no data was read");
  		*size = 0;
  	} else {
  		if (buf[0] != id) {
@@ -3300,12 +3297,11 @@ static int _hid_get_report(struct 
hid_device_priv* dev, HANDLE hid_handle, int i
  			r = LIBUSB_COMPLETED;
  		}

+		*size = MIN((size_t)read_size, *size);
  		if (id == 0) {
  			// Discard report ID
-			*size = MIN((size_t)read_size-1, *size);
  			memcpy(data, buf+1, *size);
  		} else {
-			*size = MIN((size_t)read_size, *size);
  			memcpy(data, buf, *size);
  		}
  	}
@@ -3363,6 +3359,7 @@ static int _hid_set_report(struct hid_device_priv* 
dev, HANDLE hid_handle, int i
  		}
  	}

+	// NB: The size returned by DeviceIoControl doesn't include report IDs 
when not in use (0)
  	if (!DeviceIoControl(hid_handle, ioctl_code, buf, write_size,
  		buf, write_size, &write_size, overlapped)) {
  		if (GetLastError() != ERROR_IO_PENDING) {
@@ -3376,11 +3373,9 @@ static int _hid_set_report(struct 
hid_device_priv* dev, HANDLE hid_handle, int i
  	}

  	// Transfer completed synchronously
+	*size = write_size;
  	if (write_size == 0) {
  		usbi_dbg("program assertion failed - write completed synchronously, 
but no data was written");
-		*size = 0;
-	} else {
-		*size = write_size - ((id == 0)?1:0);
  	}
  	safe_free(buf);
  	return LIBUSB_COMPLETED;
-- 
1.7.1.msysgit.0

------------------------------------------------------------------------------
Special Offer-- Download ArcSight Logger for FREE (a $49 USD value)!
Finally, a world-class log management solution at an even better price-free!
Download using promo code Free_Logger_4_Dev2Dev. Offer expires 
February 28th, so secure your free ArcSight Logger TODAY! 
http://p.sf.net/sfu/arcsight-sfd2d
_______________________________________________
Libusb-devel mailing list
Libusb-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/libusb-devel
[prev in list] [next in list] [prev in thread] [next in thread]