Fix buffer overrun at pipe_read_packet()

kkitayam · kkitayam · commit 7137a0a92f56 · 2021-12-04T01:25:34.000+09:00
diff --git a/src/portable/mentor/musb/dcd_musb.c b/src/portable/mentor/musb/dcd_musb.c
@@ -250,12 +250,12 @@ static void pipe_read_packet(void *buf, volatile void *fifo, unsigned len)
     len  -= 4;
   }
   if (len >= 2) {
-    *(uint32_t *)addr = reg->u16;
+    *(uint16_t *)addr = reg->u16;
     addr += 2;
     len  -= 2;
   }
   if (len) {
-    *(uint32_t *)addr = reg->u8;
+    *(uint8_t *)addr = reg->u8;
   }
 }
 

Original file line number	Diff line number	Diff line change
`@@ -250,12 +250,12 @@ static void pipe_read_packet(void buf, volatile void fifo, unsigned len)`
`250`	`250`	`len -= 4;`
`251`	`251`	`}`
`252`	`252`	`if (len >= 2) {`
`253`		`- (uint32_t )addr = reg->u16;`
	`253`	`+ (uint16_t )addr = reg->u16;`
`254`	`254`	`addr += 2;`
`255`	`255`	`len -= 2;`
`256`	`256`	`}`
`257`	`257`	`if (len) {`
`258`		`- (uint32_t )addr = reg->u8;`
	`258`	`+ (uint8_t )addr = reg->u8;`
`259`	`259`	`}`
`260`	`260`	`}`
`261`	`261`