good bug on vim3l
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
amlogic s905d3 bootrom | |
in usb_do_vendor_request, messages AM_REQ_WR_LARGE_MEM & AM_REQ_RD_LARGE_MEM allow to set : | |
_pcd->bulk_len : ushort <= 0x1000 (or 0xfff) | |
_pcd->bulk_num : ushort != 0 | |
they're not reset after bulk transfer is setup | |
in dwc_otg_ep_req_start: if (pcd->bulk_data_len < pcd->bulk_len) is signed. | |
In do_bulk_complete, _pcd->bulk_data_len can be underflowed : | |
_pcd->bulk_data_len = _pcd->bulk_data_len - _pcd->xfer_len | |
But also _pcd->bulk_num: | |
iVar1 = _pcd->bulk_num + -1; | |
_pcd->bulk_num = iVar1; | |
=>once underflowed, bulk transfers can continue |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment