https://git.reactos.org/?p=reactos.git;a=commitdiff;h=bf74391dcda6c76fd0bbb4e77431d933384487fe
commit bf74391dcda6c76fd0bbb4e77431d933384487fe Author: Thomas Faber <[email protected]> AuthorDate: Wed Oct 11 20:05:55 2017 +0200 [USBPORT] Avoid more integer overflows. --- drivers/usb/usbport/device.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/usb/usbport/device.c b/drivers/usb/usbport/device.c index 0a14bf8961..b9063a70bd 100644 --- a/drivers/usb/usbport/device.c +++ b/drivers/usb/usbport/device.c @@ -275,8 +275,8 @@ USBPORT_OpenInterface(IN PURB Urb, NumEndpoints = InterfaceDescriptor->bNumEndpoints; - Length = sizeof(USBD_INTERFACE_INFORMATION) + - (NumEndpoints - 1) * sizeof(USBD_PIPE_INFORMATION); + Length = FIELD_OFFSET(USBD_INTERFACE_INFORMATION, Pipes) + + NumEndpoints * sizeof(USBD_PIPE_INFORMATION); if (InterfaceInfo->AlternateSetting && IsSetInterface) { @@ -289,8 +289,8 @@ USBPORT_OpenInterface(IN PURB Urb, } else { - HandleLength = sizeof(USBPORT_INTERFACE_HANDLE) + - (NumEndpoints - 1) * sizeof(USBPORT_PIPE_HANDLE); + HandleLength = FIELD_OFFSET(USBPORT_INTERFACE_HANDLE, PipeHandle) + + NumEndpoints * sizeof(USBPORT_PIPE_HANDLE); InterfaceHandle = ExAllocatePoolWithTag(NonPagedPool, HandleLength, @@ -500,8 +500,8 @@ USBPORT_InitInterfaceInfo(IN PUSBD_INTERFACE_INFORMATION InterfaceInfo, { NumberOfPipes = Descriptor->bNumEndpoints; - Length = sizeof(USBD_INTERFACE_INFORMATION) + - (NumberOfPipes - 1) * sizeof(USBD_PIPE_INFORMATION); + Length = FIELD_OFFSET(USBD_INTERFACE_INFORMATION, Pipes) + + NumberOfPipes * sizeof(USBD_PIPE_INFORMATION); if (InterfaceInfo->Length >= Length) {
