Intravision/reactos
1
0
Fork 0
mirror of https://github.com/reactos/reactos.git synced 2024-12-28 01:55:19 +00:00
Code Issues Projects Releases Packages Wiki Activity

[USBPORT] Avoid more integer overflows.

Browse source
This commit is contained in:
Thomas Faber 2017-10-11 20:05:55 +02:00 committed by Thomas Faber
parent a45779a12f
commit bf74391dcd
1 changed files with 6 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
drivers/usb/usbport/device.c
View file

@ -275,8 +275,8 @@ USBPORT_OpenInterface(IN PURB Urb,
NumEndpoints = InterfaceDescriptor->bNumEndpoints;
Length = sizeof(USBD_INTERFACE_INFORMATION) +
(NumEndpoints - 1) * sizeof(USBD_PIPE_INFORMATION);
Length = FIELD_OFFSET(USBD_INTERFACE_INFORMATION, Pipes) +
NumEndpoints * sizeof(USBD_PIPE_INFORMATION);
if (InterfaceInfo->AlternateSetting && IsSetInterface)
{
@ -289,8 +289,8 @@ USBPORT_OpenInterface(IN PURB Urb,
}
else
{
HandleLength = sizeof(USBPORT_INTERFACE_HANDLE) +
(NumEndpoints - 1) * sizeof(USBPORT_PIPE_HANDLE);
HandleLength = FIELD_OFFSET(USBPORT_INTERFACE_HANDLE, PipeHandle) +
NumEndpoints * sizeof(USBPORT_PIPE_HANDLE);
InterfaceHandle = ExAllocatePoolWithTag(NonPagedPool,
HandleLength,
@ -500,8 +500,8 @@ USBPORT_InitInterfaceInfo(IN PUSBD_INTERFACE_INFORMATION InterfaceInfo,
{
NumberOfPipes = Descriptor->bNumEndpoints;
Length = sizeof(USBD_INTERFACE_INFORMATION) +
(NumberOfPipes - 1) * sizeof(USBD_PIPE_INFORMATION);
Length = FIELD_OFFSET(USBD_INTERFACE_INFORMATION, Pipes) +
NumberOfPipes * sizeof(USBD_PIPE_INFORMATION);
if (InterfaceInfo->Length >= Length)
{