usb_midi: avoid crash if trying to write a partial MIDI event

thanks to nilsding for investigating!

Fixes #15562.

Change-Id: I014769afb507881f14f69fb1cd65215dc52920c6
Reviewed-on: https://review.haiku-os.org/c/haiku/+/2048
Reviewed-by: Jérôme Duval <[email protected]>

src/add-ons/kernel/drivers/midi/usb_midi/usb_midi.cpp

@@ -646,10 +646,18 @@ usb_midi_write(driver_cookie* cookie, off_t position,
 
 	DPRINTF_DEBUG((MY_ID "MIDI write (%" B_PRIuSIZE " bytes at %" B_PRIdOFF
 		")\n", *num_bytes, position));
-	if (*num_bytes > 3 && midicode != 0xF0) {
+	// Make sure we always write exactly one MIDI event at a time.
-		DPRINTF_ERR((MY_ID "Non-SysEx packet of %ld bytes"
+	// SysEx can be of arbitrary sizes, for all others, we check that the
-			" -- too big to handle\n", *num_bytes));
+	// complete event was passed in and do not use more than that.
-		return B_ERROR;
+	// TODO add a loop to allow writing multiple events in a single write()
+	// call if desired.
+	if (midicode != 0xF0) {
+		if (*num_bytes < CINbytes[cin]) {
+			DPRINTF_ERR((MY_ID "Expected %d bytes for MIDI command %x but got "
+				"only %d.\n", CINbytes[cin], cin, *num_bytes));
+			return B_BAD_DATA;
+		}
+		*num_bytes = CINbytes[cin];
 	}
 
 	size_t bytes_left = *num_bytes;