From: Andy Lutomirski <redacted>
Date: Sat, 13 Jun 2020 22:32:36 +0000 (-0700)
Subject: scpi_usbtmc_libusb: Check that bulk in requests read the entire header
X-Git-Url: https://sigrok.org/gitaction?a=commitdiff_plain;h=e2283318c1f34cd9a1933b88aef1b93f9782cf11;p=libsigrok.git

scpi_usbtmc_libusb: Check that bulk in requests read the entire header

The Rigol DS1054Z sometimes returns zero bytes in response to a bulk in
request.  sigrok ends up reading out of bounds and failing ungracefully
when this happens.  Check that libusb returned a full USBTMC header and
fail gracefully if it did not.
---

diff --git a/src/scpi/scpi_usbtmc_libusb.c b/src/scpi/scpi_usbtmc_libusb.c
index d45d1f4c..c8bcd0dc 100644
--- a/src/scpi/scpi_usbtmc_libusb.c
+++ b/src/scpi/scpi_usbtmc_libusb.c
@@ -534,6 +534,11 @@ static int scpi_usbtmc_bulkin_start(struct scpi_usbtmc_libusb *uscpi,
 		return SR_ERR;
 	}
 
+	if (transferred < USBTMC_BULK_HEADER_SIZE) {
+		sr_err("USBTMC bulk in returned too little data: %d/%d bytes\n", transferred, size);
+		return SR_ERR;
+	}
+
 	if (usbtmc_bulk_in_header_read(data, msg_id, uscpi->bTag, &message_size,
 	                               transfer_attributes) != SR_OK) {
 		sr_err("USBTMC invalid bulk in header.");