Skip to content

Commit 1bcf66f

Browse files
committed
Check buffer existence in tud callbacks (addresses adafruit#5020)
1 parent 38f4281 commit 1bcf66f

File tree

1 file changed

+8
-3
lines changed

1 file changed

+8
-3
lines changed

shared-module/usb_hid/Device.c

+8-3
Original file line numberDiff line numberDiff line change
@@ -280,8 +280,11 @@ uint16_t tud_hid_get_report_cb(uint8_t itf, uint8_t report_id, hid_report_type_t
280280
size_t id_idx;
281281
// Find device with this report id, and get the report id index.
282282
if (usb_hid_get_device_with_report_id(report_id, &hid_device, &id_idx)) {
283-
memcpy(buffer, hid_device->in_report_buffers[id_idx], reqlen);
284-
return reqlen;
283+
// Make sure buffer exists before trying to copy into it.
284+
if (hid_device->in_report_buffers[id_idx]) {
285+
memcpy(buffer, hid_device->in_report_buffers[id_idx], reqlen);
286+
return reqlen;
287+
}
285288
}
286289
return 0;
287290
}
@@ -302,7 +305,9 @@ void tud_hid_set_report_cb(uint8_t itf, uint8_t report_id, hid_report_type_t rep
302305
// Find device with this report id, and get the report id index.
303306
if (usb_hid_get_device_with_report_id(report_id, &hid_device, &id_idx)) {
304307
// If a report of the correct size has been read, save it in the proper OUT report buffer.
305-
if (hid_device && hid_device->out_report_lengths[id_idx] >= bufsize) {
308+
if (hid_device &&
309+
hid_device->out_report_buffers[id_idx] &&
310+
hid_device->out_report_lengths[id_idx] >= bufsize) {
306311
memcpy(hid_device->out_report_buffers[id_idx], buffer, bufsize);
307312
}
308313
}

0 commit comments

Comments
 (0)