Re: usb-serial.c question - potential Memory fault

On Tue, Jul 31, 2007 at 07:13:08AM +0200, Alain Degreffe wrote:
> Well I try to follow pl2303
> 
> wMaxPacketSize     0x0040  1x 64 bytes is the size retuned by the endpoint
> (I just plug my own pl2303 to check the value)
> 
> line / code
> 
> 330                 priv->buf = pl2303_buf_alloc(PL2303_BUF_SIZE); where
> PL2303_BUF_SIZE = 1024 !
> 
> 
> 377         count = pl2303_buf_get(priv->buf,
> port->write_urb->transfer_buffer, <--- here
> port->write_urb->transfer_buffer size = wMaxPacketSize
> 
> 
> 
> 378                                port->bulk_out_size);
> 379
> 
> 278 static unsigned int pl2303_buf_get(struct pl2303_buf *pb, char *buf,
> 279                                    unsigned int count)
> {
> 
> 286         len = pl2303_buf_data_avail(pb);
> 
> 293         len = pb->buf_buf + pb->buf_size - pb->buf_get;
> 
> 295                 memcpy(buf, pb->buf_get, len); <----------- here len
> is nerver bigger than 64 ?????

I don't see how it it would be bigger, that function checks that len
will never be bigger than count.

Do you?

thanks,

greg k-h

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >>  http://get.splunk.com/
_______________________________________________
[email protected]
To unsubscribe, use the last form field at:
https://lists.sourceforge.net/lists/listinfo/linux-usb-devel