From 5cc760197a3c7b60e6c63014ab06728a6e69cbfe Mon Sep 17 00:00:00 2001 From: Michael Lotz Date: Fri, 10 Jun 2011 17:20:27 +0000 Subject: [PATCH] Apply limits to the transfer lengths. At least in the case where a one byte FTDI header is used that only has 6 bits of length info this would've previously potentially overflowed depending on the input size. git-svn-id: file:///srv/svn/repos/haiku/haiku/trunk@42088 a95241bf-73f2-0310-859d-f6bbb57e9c96 --- src/add-ons/kernel/drivers/ports/usb_serial/FTDI.cpp | 5 ++++- src/add-ons/kernel/drivers/ports/usb_serial/KLSI.cpp | 5 ++++- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/src/add-ons/kernel/drivers/ports/usb_serial/FTDI.cpp b/src/add-ons/kernel/drivers/ports/usb_serial/FTDI.cpp index 21c5bd0c8e..1d77c605c1 100644 --- a/src/add-ons/kernel/drivers/ports/usb_serial/FTDI.cpp +++ b/src/add-ons/kernel/drivers/ports/usb_serial/FTDI.cpp @@ -225,9 +225,12 @@ FTDIDevice::OnRead(char **buffer, size_t *numBytes) void FTDIDevice::OnWrite(const char *buffer, size_t *numBytes, size_t *packetBytes) { + if (*numBytes > FTDI_BUFFER_SIZE) + *numBytes = *packetBytes = FTDI_BUFFER_SIZE; + char *writeBuffer = WriteBuffer(); if (fHeaderLength > 0) { - if (*numBytes >= WriteBufferSize() - fHeaderLength) + if (*numBytes > WriteBufferSize() - fHeaderLength) *numBytes = *packetBytes = WriteBufferSize() - fHeaderLength; *writeBuffer = FTDI_OUT_TAG(*numBytes, FTDI_PIT_DEFAULT); diff --git a/src/add-ons/kernel/drivers/ports/usb_serial/KLSI.cpp b/src/add-ons/kernel/drivers/ports/usb_serial/KLSI.cpp index b580f3a9a4..bf5ed8090d 100644 --- a/src/add-ons/kernel/drivers/ports/usb_serial/KLSI.cpp +++ b/src/add-ons/kernel/drivers/ports/usb_serial/KLSI.cpp @@ -149,7 +149,10 @@ KLSIDevice::OnRead(char **buffer, size_t *numBytes) void KLSIDevice::OnWrite(const char *buffer, size_t *numBytes, size_t *packetBytes) { - if (*numBytes >= WriteBufferSize() - 2) + if (*numBytes > KLSI_BUFFER_SIZE) + *numBytes = *packetBytes = KLSI_BUFFER_SIZE; + + if (*numBytes > WriteBufferSize() - 2) *numBytes = *packetBytes = WriteBufferSize() - 2; char *writeBuffer = WriteBuffer();