From e33c30c14949d4712a663cddaddc61a57776f849 Mon Sep 17 00:00:00 2001 From: Alec Berg Date: Wed, 21 Jan 2015 18:09:49 -0800 Subject: [PATCH] pd: make sure all host commands range check type-C port arg Add range checking of type-C port arg to host commands that weren't already doing so. BUG=chrome-os-partner:31492 BRANCH=samus TEST=make -j buildall > ectool --dev=1 usbpd 2 EC result 3 (INVALID_PARAM) Change-Id: I0bd7677857f28fc002a039c477e87efa876d0134 Signed-off-by: Alec Berg Reviewed-on: https://chromium-review.googlesource.com/242423 Reviewed-by: Vincent Palatin --- common/usb_pd_protocol.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/common/usb_pd_protocol.c b/common/usb_pd_protocol.c index c18af2093a..234f024624 100644 --- a/common/usb_pd_protocol.c +++ b/common/usb_pd_protocol.c @@ -3262,6 +3262,9 @@ static int hc_usb_pd_control(struct host_cmd_handler_args *args) struct ec_response_usb_pd_control_v1 *r_v1 = args->response; struct ec_response_usb_pd_control *r = args->response; + if (p->port >= PD_PORT_COUNT) + return EC_RES_INVALID_PARAM; + if (p->role >= USB_PD_CTRL_ROLE_COUNT || p->mux >= USB_PD_CTRL_MUX_COUNT) return EC_RES_INVALID_PARAM; @@ -3305,6 +3308,9 @@ static int hc_remote_flash(struct host_cmd_handler_args *args) int i, size, rv = EC_RES_SUCCESS; timestamp_t timeout; + if (port >= PD_PORT_COUNT) + return EC_RES_INVALID_PARAM; + if (p->size + sizeof(*p) > args->params_size) return EC_RES_INVALID_PARAM;