drivers/libusb1.c: fix wrong return value of nut_libusb_get_interrupt() #2701
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
cf github networkupstools#2401. When global var 'interrupt_size' is not set, a transfer size of SMALLBUF (512) is requested when calling libusb_interrupt_transfer(). Our function nut_libusb_get_interrupt() should return the actual transferred size. Otherwise, the caller will attempt to parse any uninitialized data in the buffer after the response. In libusb0.c this was done correctly by using the return value of usb_interrupt_read(). With libusb1, the transferred size is written to tmpbufsize, and should therefore be used as the return val. Signed-off-by: fenugrec <[email protected]>
jimklimov
added
bug
USB
impacts-release-2.8.0
jimklimov
reviewed
Nov 29, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
cf github #2401
When global var 'interrupt_size' is not set, a transfer size of SMALLBUF (512) is requested when calling libusb_interrupt_transfer(). Our function nut_libusb_get_interrupt() should return the actual transferred size. Otherwise, the caller will attempt to parse any uninitialized data in the buffer after the response.
In libusb0.c this was done correctly by using the return value of usb_interrupt_read(). With libusb1, the transferred size is written to tmpbufsize, and should therefore be used as the return val.
can we trust libusb to not return a value outside the range of
usb_ctrl_charbufsize? I did not add a check for this and simply cast the int. [edit - as noted in the review comments, this condition is already checked... 4 lines above)