Răsfoiți Sursa

audio_device: Fix NULL pointer access in audiod_xfer_cb

b_bytes_copied was pointer with NULL value instead of
plain variable.
NULL pointer was passed to audio_tx_done_cb() and dereference
as well.

Now variable is not a pointer.
Jerzy Kasenberg 5 ani în urmă
părinte
comite
a3eff0c51a
1 a modificat fișierele cu 3 adăugiri și 3 ștergeri
  1. 3 3
      src/class/audio/audio_device.c

+ 3 - 3
src/class/audio/audio_device.c

@@ -1002,10 +1002,10 @@ bool audiod_xfer_cb(uint8_t rhport, uint8_t ep_addr, xfer_result_t result, uint3
       // This is the only place where we can fill something into the EPs buffer!
 
       // Load new data
-      uint16_t *n_bytes_copied = NULL;
-      TU_VERIFY(audio_tx_done_cb(rhport, &_audiod_itf[idxDriver], n_bytes_copied));
+      uint16_t n_bytes_copied;
+      TU_VERIFY(audio_tx_done_cb(rhport, &_audiod_itf[idxDriver], &n_bytes_copied));
 
-      if (*n_bytes_copied == 0)
+      if (n_bytes_copied == 0)
       {
         // Load with ZLP
         return usbd_edpt_xfer(rhport, ep_addr, NULL, 0);