diff --git a/common/usbx_host_classes/src/ux_host_class_hid_report_descriptor_get.c b/common/usbx_host_classes/src/ux_host_class_hid_report_descriptor_get.c index 2e52ba24..bb39cfe6 100644 --- a/common/usbx_host_classes/src/ux_host_class_hid_report_descriptor_get.c +++ b/common/usbx_host_classes/src/ux_host_class_hid_report_descriptor_get.c @@ -112,15 +112,15 @@ UINT status; /* Check for correct transfer and entire descriptor returned. */ if ((status == UX_SUCCESS) && (transfer_request -> ux_transfer_request_actual_length == length)) { - + UINT analysis_failure; /* Parse the report descriptor and build the report items. */ while (length) { - + /* Get one item from the report and analyze it. */ /* Make sure this descriptor has at least the minimum length. */ - if(length < 3) + analysis_failure = _ux_host_class_hid_report_item_analyse(descriptor, &item); + if (analysis_failure) { - /* Error trap. */ _ux_system_error_handler(UX_SYSTEM_LEVEL_THREAD, UX_SYSTEM_CONTEXT_CLASS, UX_DESCRIPTOR_CORRUPTED); @@ -130,10 +130,7 @@ UINT status; /* Return error status. */ status = (UX_DESCRIPTOR_CORRUPTED); } - - /* Get one item from the report and analyze it. */ - _ux_host_class_hid_report_item_analyse(descriptor, &item); - + /* Point the descriptor right after the item identifier. */ descriptor += item.ux_host_class_hid_item_report_format; diff --git a/common/usbx_host_classes/src/ux_host_class_hid_report_item_analyse.c b/common/usbx_host_classes/src/ux_host_class_hid_report_item_analyse.c index 68f0f6ac..7ff20bf7 100644 --- a/common/usbx_host_classes/src/ux_host_class_hid_report_item_analyse.c +++ b/common/usbx_host_classes/src/ux_host_class_hid_report_item_analyse.c @@ -73,7 +73,7 @@ UINT _ux_host_class_hid_report_item_analyse(UCHAR *descriptor, UX_HOST_CLASS_HI { UCHAR item_byte; - +UINT result = UX_SUCCESS; /* Get the first byte from the descriptor. */ item_byte = *descriptor; @@ -89,11 +89,19 @@ UCHAR item_byte; /* Set the type. */ item -> ux_host_class_hid_item_report_type = (item_byte >> 2) & 3; - /* Get its length (byte 1). */ - item -> ux_host_class_hid_item_report_length = (USHORT) *(descriptor + 1); + /* Make sure descriptor has minimal length.*/ + if (sizeof(descriptor) >= 3) + { + /* Get its length (byte 1). */ + item -> ux_host_class_hid_item_report_length = (USHORT) *(descriptor + 1); - /* Then the tag (byte 2). */ - item -> ux_host_class_hid_item_report_tag = *(descriptor + 2); + /* Then the tag (byte 2). */ + item -> ux_host_class_hid_item_report_tag = *(descriptor + 2); + } + else + { + result = UX_DESCRIPTOR_CORRUPTED; + } } else { @@ -124,6 +132,6 @@ UCHAR item_byte; } /* Return successful completion. */ - return(UX_SUCCESS); + return(result); }