[Wine-patches] [eterhack 01/23] usbhub.sys: Improve handling URB_FUNCTION_GET_DESCRIPTOR_FROM_DEVICE.

[Alexander Morozov]

---
 dlls/usbhub.sys/usbhub.c |   55 ++++++++++++++++++++++++---------------------
 1 files changed, 29 insertions(+), 26 deletions(-)

diff --git a/dlls/usbhub.sys/usbhub.c b/dlls/usbhub.sys/usbhub.c
index 53199f9..04e00ad 100644
--- a/dlls/usbhub.sys/usbhub.c
+++ b/dlls/usbhub.sys/usbhub.c
@@ -77,7 +77,7 @@ struct PdoExtension
 
 #ifdef HAVE_LIBUSB
 
-static void add_data( char **dst, int *dst_size, const void *src, int src_size )
+static void add_data( char **dst, ULONG *dst_size, const void *src, ULONG src_size )
 {
     int copy;
 
@@ -133,9 +133,19 @@ static NTSTATUS WINAPI usbhub_internal_ioctl( DEVICE_OBJECT *device, IRP *irp )
             {
                 struct _URB_CONTROL_DESCRIPTOR_REQUEST *request =
                         &urb->u.UrbControlDescriptorRequest;
+                ULONG size = request->TransferBufferLength;
+                char *buf = request->TransferBuffer;
 
                 TRACE( "URB_FUNCTION_GET_DESCRIPTOR_FROM_DEVICE\n" );
 
+                if (buf == NULL && request->TransferBufferMDL != NULL)
+                    buf = request->TransferBufferMDL->MappedSystemVa;
+                if (buf == NULL && size)
+                {
+                    status = STATUS_INVALID_PARAMETER;
+                    break;
+                }
+
                 switch (request->DescriptorType)
                 {
                 case USB_DEVICE_DESCRIPTOR_TYPE:
@@ -143,32 +153,23 @@ static NTSTATUS WINAPI usbhub_internal_ioctl( DEVICE_OBJECT *device, IRP *irp )
                     {
                         struct libusb_device_descriptor desc;
 
-                        if (request->TransferBuffer == NULL)
+                        if (libusb_get_device_descriptor( inst->dev, &desc ))
                             break;
-                        if (sizeof(USB_DEVICE_DESCRIPTOR) <= request->TransferBufferLength)
-                        {
-                            if (libusb_get_device_descriptor( inst->dev, &desc ))
-                                break;
-                            memcpy( request->TransferBuffer, &desc,
-                                    sizeof(USB_DEVICE_DESCRIPTOR) );
-                            status = STATUS_SUCCESS;
-                        }
+                        memcpy( buf, &desc, (size < sizeof(USB_DEVICE_DESCRIPTOR)) ?
+                                size : sizeof(USB_DEVICE_DESCRIPTOR) );
+                        status = STATUS_SUCCESS;
                     }
                     break;
                 case USB_CONFIGURATION_DESCRIPTOR_TYPE:
                     TRACE( "USB_CONFIGURATION_DESCRIPTOR_TYPE\n" );
                     {
                         unsigned int i, k;
-                        char *buf = request->TransferBuffer;
                         struct libusb_config_descriptor *conf;
                         const struct libusb_interface_descriptor *intf;
                         const struct libusb_endpoint_descriptor *endp;
-                        int size = request->TransferBufferLength;
 
                         /* FIXME: case of num_altsetting > 1 */
 
-                        if (buf == NULL)
-                            break;
                         if (libusb_get_active_config_descriptor( inst->dev, &conf ))
                             break;
                         add_data( &buf, &size, conf,
@@ -319,36 +320,38 @@ static NTSTATUS WINAPI usbhub_internal_ioctl( DEVICE_OBJECT *device, IRP *irp )
             {
                 struct _URB_CONTROL_DESCRIPTOR_REQUEST *request =
                         &urb->u.UrbControlDescriptorRequest;
+                ULONG size = request->TransferBufferLength;
+                char *buf = request->TransferBuffer;
 
                 TRACE( "URB_FUNCTION_GET_DESCRIPTOR_FROM_DEVICE\n" );
 
+                if (buf == NULL && request->TransferBufferMDL != NULL)
+                    buf = request->TransferBufferMDL->MappedSystemVa;
+                if (buf == NULL && size)
+                {
+                    status = STATUS_INVALID_PARAMETER;
+                    break;
+                }
+
                 switch (request->DescriptorType)
                 {
                 case USB_DEVICE_DESCRIPTOR_TYPE:
                     TRACE( "USB_DEVICE_DESCRIPTOR_TYPE\n" );
-                    if (request->TransferBuffer == NULL)
-                        break;
-                    if (sizeof(USB_DEVICE_DESCRIPTOR) <= request->TransferBufferLength)
-                    {
-                        memcpy( request->TransferBuffer, &inst->dev->descriptor,
-                                sizeof(USB_DEVICE_DESCRIPTOR) );
-                        status = STATUS_SUCCESS;
-                    }
+                    memcpy( buf, &inst->dev->descriptor,
+                            (size < sizeof(USB_DEVICE_DESCRIPTOR)) ?
+                            size : sizeof(USB_DEVICE_DESCRIPTOR) );
+                    status = STATUS_SUCCESS;
                     break;
                 case USB_CONFIGURATION_DESCRIPTOR_TYPE:
                     TRACE( "USB_CONFIGURATION_DESCRIPTOR_TYPE\n" );
                     {
                         unsigned int i, k;
-                        char *buf = request->TransferBuffer;
                         struct usb_config_descriptor *conf = &inst->dev->config[0];
                         struct usb_interface_descriptor *intf;
                         struct usb_endpoint_descriptor *endp;
-                        int size = request->TransferBufferLength;
 
                         /* FIXME: case of num_altsetting > 1 */
 
-                        if (buf == NULL)
-                            break;
                         add_data( &buf, &size, conf,
                                 sizeof(USB_CONFIGURATION_DESCRIPTOR) );
                         if (size > 0 && conf->extra)
-- 
1.6.3.1