Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -112,15 +112,15 @@ UINT status;
/* Check for correct transfer and entire descriptor returned. */
if ((status == UX_SUCCESS) && (transfer_request -> ux_transfer_request_actual_length == length))
{

UINT analysis_failure;
/* Parse the report descriptor and build the report items. */
while (length)
{

/* Get one item from the report and analyze it. */
/* Make sure this descriptor has at least the minimum length. */
if(length < 3)
analysis_failure = _ux_host_class_hid_report_item_analyse(descriptor, &item);
if (analysis_failure)
{

/* Error trap. */
_ux_system_error_handler(UX_SYSTEM_LEVEL_THREAD, UX_SYSTEM_CONTEXT_CLASS, UX_DESCRIPTOR_CORRUPTED);

Expand All @@ -130,10 +130,7 @@ UINT status;
/* Return error status. */
status = (UX_DESCRIPTOR_CORRUPTED);
}

/* Get one item from the report and analyze it. */
_ux_host_class_hid_report_item_analyse(descriptor, &item);


/* Point the descriptor right after the item identifier. */
descriptor += item.ux_host_class_hid_item_report_format;

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -73,7 +73,7 @@ UINT _ux_host_class_hid_report_item_analyse(UCHAR *descriptor, UX_HOST_CLASS_HI
{

UCHAR item_byte;

UINT result = UX_SUCCESS;

/* Get the first byte from the descriptor. */
item_byte = *descriptor;
Expand All @@ -89,11 +89,19 @@ UCHAR item_byte;
/* Set the type. */
item -> ux_host_class_hid_item_report_type = (item_byte >> 2) & 3;

/* Get its length (byte 1). */
item -> ux_host_class_hid_item_report_length = (USHORT) *(descriptor + 1);
/* Make sure descriptor has minimal length.*/
if (sizeof(descriptor) >= 3)
{
/* Get its length (byte 1). */
item -> ux_host_class_hid_item_report_length = (USHORT) *(descriptor + 1);

/* Then the tag (byte 2). */
item -> ux_host_class_hid_item_report_tag = *(descriptor + 2);
/* Then the tag (byte 2). */
item -> ux_host_class_hid_item_report_tag = *(descriptor + 2);
}
else
{
result = UX_DESCRIPTOR_CORRUPTED;
}
}
else
{
Expand Down Expand Up @@ -124,6 +132,6 @@ UCHAR item_byte;
}

/* Return successful completion. */
return(UX_SUCCESS);
return(result);
}