Re: usb-serial.c question - potential Memory fault

On Mon, Jul 30, 2007 at 07:04:51AM +0200, [email protected] wrote:
> Hi Greg,
> 
>  
> 
> After a new complete reading of my code against usb-serial.c, I finally
> found ( I hope ) my problem.
> 
> In usb-serial.c, when bulk_in/out buffers are initialized, each  buffer size
> are the same as the wMaxPacketSize given by the endpoint.
> 
> So, in my case, my device have a value of 64 bytes and I send and receive
> bulk data that might have 256 bytes length !!! And like pl2303, I just copy
> the user data to port->write_urb->transfer_buffer.

Hm, you need to not send more data than your buffer can hold, that is a
very simple check you need to always make.

> For all driver that use usb-serial for the probe function, this can be a
> problem (like for me). I have checked for example the pl2303 that never
> check this value before the memcpy.

Where do you see that?  I see pl2303_send() checking the size of the
buffer when it is copied into it.

thanks,

greg k-h

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >>  http://get.splunk.com/
_______________________________________________
[email protected]
To unsubscribe, use the last form field at:
https://lists.sourceforge.net/lists/listinfo/linux-usb-devel