MdeModulePkg/Usb: Make sure data from HW is no more than expected

Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Ruiyu Ni <ruiyu.ni@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Star Zeng <star.zeng@intel.com>
Cc: Hao A Wu <hao.a.wu@intel.com>
Reviewed-by: Hao Wu <hao.a.wu@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>

diff --git a/MdeModulePkg/Bus/Pci/EhciDxe/EhciSched.c b/MdeModulePkg/Bus/Pci/EhciDxe/EhciSched.c
index fea6f47f4c04146e85cae140a9689dde97527403..168280be81d7d7a4ce02dfc33d933db35a14b3cf 100644 (file)
--- a/MdeModulePkg/Bus/Pci/EhciDxe/EhciSched.c
+++ b/MdeModulePkg/Bus/Pci/EhciDxe/EhciSched.c
@@ -1009,9 +1009,12 @@ EhcMonitorAsyncRequests (
     ProcBuf = NULL;\r
 \r
     if (Urb->Result == EFI_USB_NOERROR) {\r
-      ASSERT (Urb->Completed <= Urb->DataLen);\r
-\r
-      ProcBuf = AllocatePool (Urb->Completed);\r
+      //\r
+      // Make sure the data received from HW is no more than expected.\r
+      //\r
+      if (Urb->Completed <= Urb->DataLen) {\r
+        ProcBuf = AllocatePool (Urb->Completed);\r
+      }\r
 \r
       if (ProcBuf == NULL) {\r
         EhcUpdateAsyncRequest (Ehc, Urb);\r

diff --git a/MdeModulePkg/Bus/Pci/UhciDxe/UhciSched.c b/MdeModulePkg/Bus/Pci/UhciDxe/UhciSched.c
index 90f010c9985ba0d9b8559f889be9e94d60529135..f7510f3ec0ebd8ad868c836de54090121fdb101d 100644 (file)
--- a/MdeModulePkg/Bus/Pci/UhciDxe/UhciSched.c
+++ b/MdeModulePkg/Bus/Pci/UhciDxe/UhciSched.c
@@ -2,7 +2,7 @@
 \r
   The EHCI register operation routines.\r
 \r
-Copyright (c) 2007 - 2013, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2007 - 2018, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r
@@ -1001,11 +1001,12 @@ UhciMonitorAsyncReqList (
 \r
     //\r
     // Copy the data to temporary buffer if there are some\r
-    // data transferred. We may have zero-length packet\r
+    // data transferred. We may have zero-length packet.\r
+    // Make sure the data received from HW is no more than expected.\r
     //\r
     Data = NULL;\r
 \r
-    if (QhResult.Complete != 0) {\r
+    if ((QhResult.Complete != 0) && (QhResult.Complete <= AsyncReq->DataLen)) {\r
       Data = AllocatePool (QhResult.Complete);\r
 \r
       if (Data == NULL) {\r

diff --git a/MdeModulePkg/Bus/Pci/XhciDxe/XhciSched.c b/MdeModulePkg/Bus/Pci/XhciDxe/XhciSched.c
index 6a2ef4cd5d48270aee5f19364b5597aa5795a576..166c44bf5e663ea48846aeb36b7943c3742df230 100644 (file)
--- a/MdeModulePkg/Bus/Pci/XhciDxe/XhciSched.c
+++ b/MdeModulePkg/Bus/Pci/XhciDxe/XhciSched.c
@@ -1556,9 +1556,12 @@ XhcMonitorAsyncRequests (
     //\r
     ProcBuf = NULL;\r
     if (Urb->Result == EFI_USB_NOERROR) {\r
-      ASSERT (Urb->Completed <= Urb->DataLen);\r
-\r
-      ProcBuf = AllocateZeroPool (Urb->Completed);\r
+      //\r
+      // Make sure the data received from HW is no more than expected.\r
+      //\r
+      if (Urb->Completed <= Urb->DataLen) {\r
+        ProcBuf = AllocateZeroPool (Urb->Completed);\r
+      }\r
 \r
       if (ProcBuf == NULL) {\r
         XhcUpdateAsyncRequest (Xhc, Urb);\r