Skip to content

Commit abf3751

Browse files
committed
Fix Pico USB network buffer dimensions and bounds
1 parent 7df7431 commit abf3751

1 file changed

Lines changed: 7 additions & 3 deletions

File tree

  • src/port/raspberry-pico-usb-server/src

src/port/raspberry-pico-usb-server/src/main.c

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -50,11 +50,11 @@ extern char MOTD[];
5050
static struct wolfIP *IPStack = NULL;
5151

5252
/* Two static buffers for RX frames from USB host */
53-
uint8_t tusb_net_rxbuf[LINK_MTU][2];
53+
uint8_t tusb_net_rxbuf[2][LINK_MTU];
5454
uint8_t tusb_net_rxbuf_used[2] = {0, 0};
5555

5656
/* Two static buffers for TX frames to USB host */
57-
uint8_t tusb_net_txbuf[LINK_MTU][2];
57+
uint8_t tusb_net_txbuf[2][LINK_MTU];
5858
uint16_t tusb_net_txbuf_sz[2] = {0, 0};
5959

6060
/* Fixed mac-address for the raspberry side of the link.
@@ -81,6 +81,8 @@ static int ll_usb_send(struct wolfIP_ll_dev *dev, void *frame, uint32_t sz) {
8181
uint16_t sz16 = (uint16_t)sz;
8282
uint32_t i;
8383
(void) dev;
84+
if (sz > LINK_MTU)
85+
return 0;
8486
board_led_on();
8587
for (;;) {
8688
if (!tud_ready()) {
@@ -111,7 +113,7 @@ uint16_t tud_network_xmit_cb(uint8_t *dst, void *ref, uint16_t arg) {
111113
(void) ref;
112114
(void) arg;
113115
memcpy(dst, ref, arg);
114-
if (ref == tusb_net_rxbuf[0])
116+
if (ref == tusb_net_txbuf[0])
115117
tusb_net_txbuf_sz[0] = 0;
116118
else if (ref == tusb_net_txbuf[1])
117119
tusb_net_txbuf_sz[1] = 0;
@@ -127,6 +129,8 @@ uint16_t tud_network_xmit_cb(uint8_t *dst, void *ref, uint16_t arg) {
127129
static void tusb_net_push_rx(const uint8_t *src, uint16_t size) {
128130
uint8_t *dst = NULL;
129131
int i;
132+
if (size > LINK_MTU)
133+
return;
130134
for (i = 0; i < 2; i++) {
131135
if (!tusb_net_rxbuf_used[i]) {
132136
dst = tusb_net_rxbuf[i];

0 commit comments

Comments
 (0)