diff options
| author | Daisuke Nojiri <dnojiri@chromium.org> | 2023-02-23 15:04:48 -0800 |
|---|---|---|
| committer | Chromeos LUCI <chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com> | 2023-03-10 23:28:31 +0000 |
| commit | cefc03b4cf98127db38dd8f07d20569d18624317 (patch) | |
| tree | 127dcfb5558bc57a18460e1d2a9957b65871ff99 | |
| parent | 9f148e8b1371f9bbe2d125692e2321f7b2b53ee2 (diff) | |
| download | chrome-ec-cefc03b4cf98127db38dd8f07d20569d18624317.tar.gz | |
USB-PD: Trim excessive PDOs
Currently, the PE copies as many PDOs as it receives without validating
the quantity against the buffer size.
This CL makes pd_set_src_caps check the number of received PDOs and trim
them if the number exceeds the buffer size.
BUG=b:257320026
BRANCH=None
TEST=Agah.
Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org>
Change-Id: Ia139922c411db74db9c71a3738001fe08433c85d
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/ec/+/4296690
Reviewed-by: Diana Z <dzigterman@chromium.org>
| -rw-r--r-- | common/usbc/usb_pe_drp_sm.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/common/usbc/usb_pe_drp_sm.c b/common/usbc/usb_pe_drp_sm.c index b3e51c6966..2f7f83f423 100644 --- a/common/usbc/usb_pe_drp_sm.c +++ b/common/usbc/usb_pe_drp_sm.c @@ -8158,8 +8158,15 @@ const uint32_t *const pd_get_src_caps(int port) void pd_set_src_caps(int port, int cnt, uint32_t *src_caps) { + const int limit = ARRAY_SIZE(pe[port].src_caps); int i; + if (cnt > limit) { + CPRINTS("C%d: Trim PDOs (%d) exceeding limit (%d)", port, cnt, + limit); + cnt = limit; + } + pe[port].src_cap_cnt = cnt; for (i = 0; i < cnt; i++) |