Skip to content

Commit cf76af1

Browse files
authored
Merge pull request #3042 from rppicomidi/fix_3033
Fix #3033: Increase array bounds and test for overflow
2 parents c2924c5 + 3324a32 commit cf76af1

File tree

2 files changed

+5
-3
lines changed

2 files changed

+5
-3
lines changed

src/class/midi/midi_host.c

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -254,7 +254,9 @@ bool midih_open(uint8_t rhport, uint8_t dev_addr, tusb_desc_interface_t const *d
254254
TU_LOG_DRV(" Jack %s %s descriptor \r\n",
255255
tu_desc_subtype(p_desc) == MIDI_CS_INTERFACE_IN_JACK ? "IN" : "OUT",
256256
p_desc[3] == MIDI_JACK_EXTERNAL ? "External" : "Embedded");
257-
desc_cb.desc_jack[desc_cb.jack_num++] = p_desc;
257+
if (desc_cb.jack_num < TU_ARRAY_SIZE(desc_cb.desc_jack)) {
258+
desc_cb.desc_jack[desc_cb.jack_num++] = p_desc;
259+
}
258260
break;
259261
}
260262

@@ -590,8 +592,8 @@ uint32_t tuh_midi_stream_read(uint8_t idx, uint8_t *p_cable_num, uint8_t *p_buff
590592
break;
591593
default:
592594
break;
593-
cable_sysex_in_progress &= (uint16_t) ~cable_mask;
594595
}
596+
cable_sysex_in_progress &= (uint16_t) ~cable_mask;
595597
} else {
596598
// Real-time message: can be inserted into a sysex message,
597599
// so do don't clear cable_sysex_in_progress bit

src/class/midi/midi_host.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ typedef struct {
6969
const tusb_desc_endpoint_t* desc_epout; // endpoint OUT descriptor, CS_ENDPOINT is right after
7070

7171
uint8_t jack_num;
72-
const uint8_t* desc_jack[16]; // list of jack descriptors (embedded + external)
72+
const uint8_t* desc_jack[32]; // list of jack descriptors (embedded + external)
7373
} tuh_midi_descriptor_cb_t;
7474

7575
typedef struct {

0 commit comments

Comments
 (0)