From 6085999e2be6974bfb59475213331ba21a7b5872 Mon Sep 17 00:00:00 2001 From: "Man, Jianting (Meco)" <920369182@qq.com> Date: Wed, 26 Jan 2022 20:08:34 -0500 Subject: [PATCH 1/2] add rt-thread's tinyusb repo address --- README.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.rst b/README.rst index f21cd9bca..8cf4a98da 100644 --- a/README.rst +++ b/README.rst @@ -91,7 +91,7 @@ TinyUSB is completely thread-safe by pushing all Interrupt Service Request (ISR) - **No OS** - **FreeRTOS** -- `RT-Thread `_ +- `RT-Thread `_: `repo `_ - **Mynewt** Due to the newt package build system, Mynewt examples are better to be on its `own repo `_ Local Docs From 453ba529a6db41ad9e0e8cbfdedfcb48b059693e Mon Sep 17 00:00:00 2001 From: Ryzee119 Date: Fri, 28 Jan 2022 14:02:34 +1030 Subject: [PATCH 2/2] OHCI: Fix array out of bounds issue If using a USB hub, a request outside the array size can occur Original line: https://github.com/hathach/tinyusb/blob/ffb257ac17f162bc5a4c26596d7a1e954db98aa5/src/portable/ohci/ohci.h#L162 It can happen in a few places but one such example is here: https://github.com/hathach/tinyusb/blob/ffb257ac17f162bc5a4c26596d7a1e954db98aa5/src/portable/ohci/ohci.c#L460 ie. if HUB address is 5, this would be an array index out of bounds on control endpoints as `CFG_TUH_DEVICE_MAX+1` is only 5. This fix just includes num of hubs in the reserve array size. Fixing locally fixed this issue. --- src/portable/ohci/ohci.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/portable/ohci/ohci.h b/src/portable/ohci/ohci.h index cd90aa45a..8db097b06 100644 --- a/src/portable/ohci/ohci.h +++ b/src/portable/ohci/ohci.h @@ -159,7 +159,7 @@ typedef struct TU_ATTR_ALIGNED(256) struct { ohci_ed_t ed; ohci_gtd_t gtd; - }control[CFG_TUH_DEVICE_MAX+1]; + }control[CFG_TUH_DEVICE_MAX+CFG_TUH_HUB+1]; // ochi_itd_t itd[OHCI_MAX_ITD]; // itd requires alignment of 32 ohci_ed_t ed_pool[HCD_MAX_ENDPOINT];