Aren/haiku
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

usb_midi: avoid crash if trying to write a partial MIDI event

Browse Source 
thanks to nilsding for investigating!

Fixes #15562.

Change-Id: I014769afb507881f14f69fb1cd65215dc52920c6
Reviewed-on: https://review.haiku-os.org/c/haiku/+/2048
Reviewed-by: Jérôme Duval <jerome.duval@gmail.com>
This commit is contained in:
Adrien Destugues 2020-05-03 20:46:10 +02:00 committed by Jérôme Duval
parent ffd6da1724
commit 9792465ec1
1 changed files with 12 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
src/add-ons/kernel/drivers/midi/usb_midi/usb_midi.cpp
View File

@ -646,10 +646,18 @@ usb_midi_write(driver_cookie* cookie, off_t position,
DPRINTF_DEBUG((MY_ID "MIDI write (%" B_PRIuSIZE " bytes at %" B_PRIdOFF
")\n", *num_bytes, position));
if (*num_bytes > 3 && midicode != 0xF0) {
DPRINTF_ERR((MY_ID "Non-SysEx packet of %ld bytes"
" -- too big to handle\n", *num_bytes));
return B_ERROR;
// Make sure we always write exactly one MIDI event at a time.
// SysEx can be of arbitrary sizes, for all others, we check that the
// complete event was passed in and do not use more than that.
// TODO add a loop to allow writing multiple events in a single write()
// call if desired.
if (midicode != 0xF0) {
if (*num_bytes < CINbytes[cin]) {
DPRINTF_ERR((MY_ID "Expected %d bytes for MIDI command %x but got "
"only %d.\n", CINbytes[cin], cin, *num_bytes));
return B_BAD_DATA;
}
*num_bytes = CINbytes[cin];
}
size_t bytes_left = *num_bytes;