1 files changed, 16 insertions, 8 deletions

diff --git a/firmware/target/arm/usb-s3c6400x.c b/firmware/target/arm/usb-s3c6400x.c
index af90be6944..4476549aa7 100644
--- a/firmware/target/arm/usb-s3c6400x.c
+++ b/firmware/target/arm/usb-s3c6400x.c
@@ -48,10 +48,18 @@ struct ep_type
 } ;
 
 static struct ep_type endpoints[USB_NUM_ENDPOINTS];
-static union
+
+/* USB control requests may be up to 64 bytes in size.
+   Even though we never use anything more than the 8 header bytes,
+   we are required to accept request packets of up to 64 bytes size.
+   Provide buffer space for these additional payload bytes so that
+   e.g. write descriptor requests (which are rejected by us, but the
+   payload is transferred anyway) do not cause memory corruption.
+   Fixes FS#12310. -- Michael Sparmann (theseven) */
+static struct
 {
-    unsigned char data[64];
-    struct usb_ctrlrequest req;
+    struct usb_ctrlrequest header; /* 8 bytes */
+    unsigned char payload[64 - sizeof(struct usb_ctrlrequest)];
 } ctrlreq USB_DEVBSS_ATTR;
 
 int usb_drv_port_speed(void)
@@ -74,7 +82,7 @@ static void reset_endpoints(int reinit)
     DOEPCTL0 = 0x8000;  /* EP0 OUT ACTIVE */
     DOEPTSIZ0 = 0x20080040;  /* EP0 OUT Transfer Size:
                                 64 Bytes, 1 Packet, 1 Setup Packet */
-    DOEPDMA0 = &ctrlreq.data;
+    DOEPDMA0 = &ctrlreq;
     DOEPCTL0 |= 0x84000000;  /* EP0 OUT ENABLE CLEARNAK */
     if (reinit)
     {
@@ -247,14 +255,14 @@ void INT_USB_FUNC(void)
                     invalidate_dcache();
                     if (i == 0)
                     {
-                        if (ctrlreq.req.bRequest == 5)
+                        if (ctrlreq.header.bRequest == 5)
                         {
                             /* Already set the new address here,
                                before passing the packet to the core.
                                See below (usb_drv_set_address) for details. */
-                            DCFG = (DCFG & ~0x7F0) | (ctrlreq.req.wValue << 4);
+                            DCFG = (DCFG & ~0x7F0) | (ctrlreq.header.wValue << 4);
                         }
-                        usb_core_control_request(&ctrlreq.req);
+                        usb_core_control_request(&ctrlreq.header);
                     }
                     else panicf("USB: SETUP done on OUT EP%d!?", i);
                 }
@@ -262,7 +270,7 @@ void INT_USB_FUNC(void)
                 if (!i)
                 {
                     DOEPTSIZ0 = 0x20080040;
-                    DOEPDMA0 = &ctrlreq.data;
+                    DOEPDMA0 = &ctrlreq;
                     DOEPCTL0 |= 0x84000000;
                 }
                 DOEPINT(i) = epints;