Re: [RFC] usb: rh_call_control tbuf overflow fix

2013-08-05 Thread Alan Stern
On Mon, 5 Aug 2013, Sarah Sharp wrote: > > > You are completely right, no current HCD writes more than a 15 byte BOS > > > descriptor. > > > However, if a future HCD were to attempt to write a descriptor longer > > > than 15 bytes, > > > the value of wLength would be larger than the space availa

Re: [RFC] usb: rh_call_control tbuf overflow fix

2013-08-05 Thread Sarah Sharp
On Sat, Aug 03, 2013 at 11:49:04AM -0400, Alan Stern wrote: > On Fri, 2 Aug 2013, Stalley, Sean wrote: > > > > > tbuf, however, is statically allocated on the stack with a size of 15 > > > > bytes, regardless of the size specified in the URB. > > > > When this buffer is passed to the hcd via the h

RE: [RFC] usb: rh_call_control tbuf overflow fix

2013-08-03 Thread Alan Stern
On Fri, 2 Aug 2013, Stalley, Sean wrote: > > > tbuf, however, is statically allocated on the stack with a size of 15 > > > bytes, regardless of the size specified in the URB. > > > When this buffer is passed to the hcd via the hub_control() call, it > > > is advertized as being as large as the URB

Re: [RFC] usb: rh_call_control tbuf overflow fix

2013-08-02 Thread Alan Stern
On Fri, 2 Aug 2013, Sean O. Stalley wrote: > rh_call_control() contains a buffer, tbuf, which it uses to hold > USB descriptors. These discriptors are eventually copied into the > transfer_buffer in the URB. The buffer in the URB is dynamically > defined and is always large enough to hold the amo

[RFC] usb: rh_call_control tbuf overflow fix

2013-08-02 Thread Sean O. Stalley
rh_call_control() contains a buffer, tbuf, which it uses to hold USB descriptors. These discriptors are eventually copied into the transfer_buffer in the URB. The buffer in the URB is dynamically defined and is always large enough to hold the amount of data it requests. tbuf, however, is statical