Fixed possible invalid program execution when in host mode if corrupt descriptor lengths are supplied by the attached device.

Minor code cleanups to add const and reformat where missing, as well as abstract out the internal device signature start address into a macro, so that it can be altered to suit particular devices within a single architecture if needed.

Add missing documentation to the USB_Device_States_t enum.

git-svn-id: http://lufa-lib.googlecode.com/svn/trunk@1752 d5102386-fcda-11dd-9fdb-3debd5008f28

1 files changed, 9 insertions, 4 deletions

diff --git a/LUFA/Drivers/USB/Core/ConfigDescriptor.h b/LUFA/Drivers/USB/Core/ConfigDescriptor.h
index 54bf14da..634dc8ff 100644
--- a/LUFA/Drivers/USB/Core/ConfigDescriptor.h
+++ b/LUFA/Drivers/USB/Core/ConfigDescriptor.h
@@ -166,8 +166,10 @@
 			 *
 			 *  \return A value from the \ref USB_Host_GetConfigDescriptor_ErrorCodes_t enum.
 			 */
-			uint8_t USB_Host_GetDeviceConfigDescriptor(uint8_t ConfigNumber, uint16_t* const ConfigSizePtr, void* BufferPtr,
-			                                           uint16_t BufferSize) ATTR_NON_NULL_PTR_ARG(2) ATTR_NON_NULL_PTR_ARG(3);
+			uint8_t USB_Host_GetDeviceConfigDescriptor(const uint8_t ConfigNumber,
+			                                           uint16_t* const ConfigSizePtr,
+			                                           void* const BufferPtr,
+			                                           const uint16_t BufferSize) ATTR_NON_NULL_PTR_ARG(2) ATTR_NON_NULL_PTR_ARG(3);
 
 			/** Skips to the next sub-descriptor inside the configuration descriptor of the specified type value.
 			 *  The bytes remaining value is automatically decremented.
@@ -254,7 +256,7 @@
 			 */
 			uint8_t USB_GetNextDescriptorComp(uint16_t* const BytesRem,
 			                                  void** const CurrConfigLoc,
-			                                  ConfigComparatorPtr_t const ComparatorRoutine);
+			                                  const ConfigComparatorPtr_t const ComparatorRoutine);
 
 		/* Inline Functions: */
 			/** Skips over the current sub-descriptor inside the configuration descriptor, so that the pointer then
@@ -269,8 +271,11 @@
 			                                         void** CurrConfigLoc)
 			{
 				uint16_t CurrDescriptorSize = DESCRIPTOR_CAST(*CurrConfigLoc, USB_Descriptor_Header_t).Size;
+				
+				if (*BytesRem < CurrDescriptorSize)
+				  CurrDescriptorSize = *BytesRem;
 
-				*CurrConfigLoc  = ((uint8_t*)*CurrConfigLoc) + CurrDescriptorSize;
+				*CurrConfigLoc  = (void*)((uintptr_t)*CurrConfigLoc + CurrDescriptorSize);
 				*BytesRem      -= CurrDescriptorSize;
 			}