lywsvip/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2026-05-22 15:20:29 +08:00
Code Issues Packages Projects Releases Wiki Activity

[USBPORT] Avoid more integer overflows.

Browse Source
This commit is contained in:
Thomas Faber
2017-10-11 20:05:55 +02:00
committed by Thomas Faber
parent a45779a12f
commit bf74391dcd
1 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
drivers/usb/usbport/device.c
View File

@@ -275,8 +275,8 @@ USBPORT_OpenInterface(IN PURB Urb,
NumEndpoints = InterfaceDescriptor->bNumEndpoints;
Length = sizeof(USBD_INTERFACE_INFORMATION) +
(NumEndpoints - 1) * sizeof(USBD_PIPE_INFORMATION);
Length = FIELD_OFFSET(USBD_INTERFACE_INFORMATION, Pipes) +
NumEndpoints * sizeof(USBD_PIPE_INFORMATION);
if (InterfaceInfo->AlternateSetting && IsSetInterface)
{
@@ -289,8 +289,8 @@ USBPORT_OpenInterface(IN PURB Urb,
}
else
{
HandleLength = sizeof(USBPORT_INTERFACE_HANDLE) +
(NumEndpoints - 1) * sizeof(USBPORT_PIPE_HANDLE);
HandleLength = FIELD_OFFSET(USBPORT_INTERFACE_HANDLE, PipeHandle) +
NumEndpoints * sizeof(USBPORT_PIPE_HANDLE);
InterfaceHandle = ExAllocatePoolWithTag(NonPagedPool,
HandleLength,
@@ -500,8 +500,8 @@ USBPORT_InitInterfaceInfo(IN PUSBD_INTERFACE_INFORMATION InterfaceInfo,
{
NumberOfPipes = Descriptor->bNumEndpoints;
Length = sizeof(USBD_INTERFACE_INFORMATION) +
(NumberOfPipes - 1) * sizeof(USBD_PIPE_INFORMATION);
Length = FIELD_OFFSET(USBD_INTERFACE_INFORMATION, Pipes) +
NumberOfPipes * sizeof(USBD_PIPE_INFORMATION);
if (InterfaceInfo->Length >= Length)
{