Commit ffc5a1e1 authored by Reilly Grant's avatar Reilly Grant Committed by Commit Bot

[usb] Convert DCHECKs to CHECKs to narrow down crash

In issue 1084316 we see a crash in GotDescriptorFromNodeConnection()
which seems to point to a read or write outside of either the source or
destination of the memcpy. This shouldn't happen if the transfer length
given to us by the operating system is valid. These checks will narrow
down whether it is too large or too small.

Bug: 1084316
Change-Id: I1627ca80430de9d617f551de54bc81068ce20f1a
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2208174
Auto-Submit: Reilly Grant <reillyg@chromium.org>
Commit-Queue: Matt Reynolds <mattreynolds@chromium.org>
Reviewed-by: default avatarMatt Reynolds <mattreynolds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#770407}
parent 2448fd3e
......@@ -1021,9 +1021,10 @@ void UsbDeviceHandleWin::GotDescriptorFromNodeConnection(
return;
}
DCHECK_GE(bytes_transferred, sizeof(USB_DESCRIPTOR_REQUEST));
// Converted to CHECKs to investigate https://crbug.com/1084316.
CHECK_GE(bytes_transferred, sizeof(USB_DESCRIPTOR_REQUEST));
bytes_transferred -= sizeof(USB_DESCRIPTOR_REQUEST);
DCHECK_LE(bytes_transferred, original_buffer->size());
CHECK_LE(bytes_transferred, original_buffer->size());
memcpy(original_buffer->front(),
request_buffer->front() + sizeof(USB_DESCRIPTOR_REQUEST),
bytes_transferred);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment