arno/trezor-firmware
1
0
Fork 0
mirror of https://github.com/trezor/trezor-firmware.git synced 2025-03-05 09:46:07 +00:00
Code Issues Releases Wiki Activity

trezorhal: fix buffer truncation in usb_hid_read

Browse Source
This commit is contained in:
Jan Pochyla 2017-03-28 00:13:32 +02:00 committed by Pavol Rusnak
parent 8eb5cbbe13
commit c258bfdd90
1 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
micropython/trezorhal/usb_hid-impl.h
View File

@ -98,16 +98,19 @@ int usb_hid_read(uint8_t iface_num, uint8_t *buf, uint32_t len) {
return -2; // Invalid interface type return -2; // Invalid interface type
} }
usb_hid_state_t *state = &usb_ifaces[iface_num].hid; usb_hid_state_t *state = &usb_ifaces[iface_num].hid;
// Copy maximum possible amount of data and truncate the buffer length
if (len < state->rx_buffer_len) { if (len < state->rx_buffer_len) {
return 0; // Not enough data in the read buffer return 0; // Not enough data in the read buffer
} }
len = state->rx_buffer_len;
memcpy(buf, state->rx_buffer, state->rx_buffer_len); state->rx_buffer_len = 0;
memcpy(buf, state->rx_buffer, len);
// Clear NAK to indicate we are ready to read more data // Clear NAK to indicate we are ready to read more data
usb_ep_clear_nak(&usb_dev_handle, state->ep_out); usb_ep_clear_nak(&usb_dev_handle, state->ep_out);
return state->rx_buffer_len; return len;
} }
int usb_hid_write(uint8_t iface_num, const uint8_t *buf, uint32_t len) { int usb_hid_write(uint8_t iface_num, const uint8_t *buf, uint32_t len) {