diff options
| author | Anton Staaf <robotboy@chromium.org> | 2016-03-02 14:11:55 -0800 |
|---|---|---|
| committer | chrome-bot <chrome-bot@chromium.org> | 2016-03-02 20:26:20 -0800 |
| commit | bb0c3687e650415314284dabe6b00c1f5a6c42da (patch) | |
| tree | 441726d760097d9fcb9f4884841be34ce4a81c99 /include | |
| parent | ad7d6516b5dc041f9d2b1947dd550a592db09e0c (diff) | |
| download | chrome-ec-bb0c3687e650415314284dabe6b00c1f5a6c42da.tar.gz | |
USB: Add bounds checking to USB-SPI bridge read
Previously a bogus rx_count value from the USB hardware could have
caused a buffer overflow while copying from the packet ram to the DMA
bounce buffer. I'm not sure if it is possible to cause the hardware
to generate a bogus rx_count, I doubt it, but this is now nicely
paranoid
Signed-off-by: Anton Staaf <robotboy@chromium.org>
BRANCH=None
BUG=None
TEST=make buildall -j
Test SPI bridge functionality on discover board
Change-Id: I080ba1c1f05c2b0a86a4c6eb89e8c1387827466e
Reviewed-on: https://chromium-review.googlesource.com/329849
Commit-Ready: Anton Staaf <robotboy@chromium.org>
Tested-by: Anton Staaf <robotboy@chromium.org>
Reviewed-by: Nick Sanders <nsanders@google.com>
Diffstat (limited to 'include')
0 files changed, 0 insertions, 0 deletions