Skip to content

Commit 37e6f49

Browse files
authored
Merge pull request #2964 from hathach/fix-2939
fix bug introduced by 2939, with correct offset check logic
2 parents 597446f + f6f02f1 commit 37e6f49

File tree

2 files changed

+13
-4
lines changed

2 files changed

+13
-4
lines changed

examples/device/cdc_msc/src/msc_disk.c

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -190,10 +190,14 @@ int32_t tud_msc_read10_cb(uint8_t lun, uint32_t lba, uint32_t offset, void* buff
190190
(void) lun;
191191

192192
// out of ramdisk
193-
if ( lba >= DISK_BLOCK_NUM ) return -1;
193+
if ( lba >= DISK_BLOCK_NUM ) {
194+
return -1;
195+
}
194196

195197
// Check for overflow of offset + bufsize
196-
if ( offset + bufsize >= DISK_BLOCK_SIZE ) return -1;
198+
if ( offset + bufsize > DISK_BLOCK_SIZE ) {
199+
return -1;
200+
}
197201

198202
uint8_t const* addr = msc_disk[lba] + offset;
199203
memcpy(buffer, addr, bufsize);

examples/device/cdc_msc_freertos/src/msc_disk.c

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -190,9 +190,14 @@ int32_t tud_msc_read10_cb(uint8_t lun, uint32_t lba, uint32_t offset, void* buff
190190
(void) lun;
191191

192192
// out of ramdisk
193-
if ( lba >= DISK_BLOCK_NUM ) return -1;
193+
if ( lba >= DISK_BLOCK_NUM ) {
194+
return -1;
195+
}
196+
194197
// Check for overflow of offset + bufsize
195-
if ( offset + bufsize >= DISK_BLOCK_SIZE ) return -1;
198+
if ( offset + bufsize > DISK_BLOCK_SIZE ) {
199+
return -1;
200+
}
196201

197202
uint8_t const* addr = msc_disk[lba] + offset;
198203
memcpy(buffer, addr, bufsize);

0 commit comments

Comments
 (0)