Skip to content

Commit a40f1ad

Browse files
author
Alrik Vidstrom
committed
Add guards against uninitialized host pointer
An older fix (commit 72d0aa6) introduced the possiblity of dereferencing an uninitialized host pointer by moving the getHostInst() call from USBHostMSD()'s constructor to connect(). This is now solved by adding guards against an uninitialized host pointer in checkResult(), SCSITransfer() and getMaxLun(). The practical implication of the bug was that mounting before connecting led to a crash, but now just leads to an error message from the mount call.
1 parent 3d1019e commit a40f1ad

File tree

2 files changed

+20
-1
lines changed

2 files changed

+20
-1
lines changed

src/USBHostMSD/USBHostMSD.cpp

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -187,6 +187,12 @@ int USBHostMSD::inquiry(uint8_t lun, uint8_t page_code)
187187

188188
int USBHostMSD::checkResult(uint8_t res, USBEndpoint * ep)
189189
{
190+
// Guard against host not being initialized
191+
if (nullptr == host)
192+
{
193+
return -1;
194+
}
195+
190196
// if ep stalled: send clear feature
191197
if (res == USB_TYPE_STALL_ERROR) {
192198
res = host->controlWrite( dev,
@@ -211,6 +217,12 @@ int USBHostMSD::SCSITransfer(uint8_t * cmd, uint8_t cmd_len, int flags, uint8_t
211217

212218
int res = 0;
213219

220+
// Guard against host not being initialized
221+
if (nullptr == host)
222+
{
223+
return -1;
224+
}
225+
214226
cbw.Signature = CBW_SIGNATURE;
215227
cbw.Tag = 0;
216228
cbw.DataLength = transfer_len;
@@ -310,6 +322,13 @@ int USBHostMSD::dataTransfer(uint8_t * buf, uint32_t block, uint8_t nbBlock, int
310322
int USBHostMSD::getMaxLun()
311323
{
312324
uint8_t buf[1], res;
325+
326+
// Guard against host not being initialized
327+
if (nullptr == host)
328+
{
329+
return -1;
330+
}
331+
313332
res = host->controlRead( dev, USB_RECIPIENT_INTERFACE | USB_DEVICE_TO_HOST | USB_REQUEST_TYPE_CLASS,
314333
0xfe, 0, msd_intf, buf, 1);
315334
USB_DBG("max lun: %d", buf[0]);

src/USBHostMSD/USBHostMSD.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ class USBHostMSD : public IUSBEnumerator, public mbed::BlockDevice
7575

7676

7777
private:
78-
USBHost * host;
78+
USBHost * host = nullptr;
7979
USBDeviceConnected * dev;
8080
bool dev_connected;
8181
USBEndpoint * bulk_in;

0 commit comments

Comments
 (0)