From fb0214278266f4f3e55ad0fa00522a6f8f6bb68f Mon Sep 17 00:00:00 2001 From: PulkoMandy Date: Sat, 11 Jun 2022 19:39:11 +0200 Subject: [PATCH] usb_rndis: fix handling of multiple packets in one USB transaction I got my pointer math wrong because some things in RNDIS use uint32 as the base, but some things are in bytes. Most of the time this would result in an offset past the end of the USB buffer, so it would just lead to ignoring all but the first packet. But if the first packet was small enough, it would point somewhere still in the buffer, and we would read the wrong data. Fixes #17775 Change-Id: I32ec0081336b1f772d4dc3099a0ac2c691aa12f0 Reviewed-on: https://review.haiku-os.org/c/haiku/+/5377 Reviewed-by: Adrien Destugues --- .../kernel/drivers/network/ether/usb_rndis/RNDISDevice.cpp | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/add-ons/kernel/drivers/network/ether/usb_rndis/RNDISDevice.cpp b/src/add-ons/kernel/drivers/network/ether/usb_rndis/RNDISDevice.cpp index 1b17befba3..c38e11758b 100644 --- a/src/add-ons/kernel/drivers/network/ether/usb_rndis/RNDISDevice.cpp +++ b/src/add-ons/kernel/drivers/network/ether/usb_rndis/RNDISDevice.cpp @@ -316,7 +316,9 @@ RNDISDevice::Read(uint8 *buffer, size_t *numBytes) fReadHeader[1], fReadHeader[2], fReadHeader[3]); // Advance to next packet - fReadHeader += fReadHeader[1]; + fReadHeader = (uint32*)((uint8*)fReadHeader + fReadHeader[1]); + + // Are we past the end of the buffer? If so, prepare to receive another one on the next read if ((uint32)((uint8*)fReadHeader - fReadBuffer) >= fActualLengthRead) fReadHeader = NULL;