From 5e040ae477cfa76b1708eb32f12cdb6832203aa2 Mon Sep 17 00:00:00 2001 From: "Philip P. Moltmann" Date: Tue, 20 Sep 2016 14:09:20 -0700 Subject: [PATCH] Clarify UsbConnection#bulkTransfer api behavior - Do not allow negative length as inside of JNI this is interpreted as unsigned value which lead to memory corruptions. - Document behavior for uncommon but usable values of parameters Test: Ran CTS verifier UBS device test Change-Id: I0899a2831c6dd2617528a5e79ea21932f6a66c13 --- core/java/android/hardware/usb/UsbDeviceConnection.java | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/core/java/android/hardware/usb/UsbDeviceConnection.java b/core/java/android/hardware/usb/UsbDeviceConnection.java index 5a7992664a031..8b3b8f3113d22 100644 --- a/core/java/android/hardware/usb/UsbDeviceConnection.java +++ b/core/java/android/hardware/usb/UsbDeviceConnection.java @@ -198,9 +198,10 @@ public class UsbDeviceConnection { *

* * @param endpoint the endpoint for this transaction - * @param buffer buffer for data to send or receive + * @param buffer buffer for data to send or receive; can be {@code null} to wait for next + * transaction without reading data * @param length the length of the data to send or receive - * @param timeout in milliseconds + * @param timeout in milliseconds, 0 is infinite * @return length of data transferred (or zero) for success, * or negative value for failure */ @@ -217,7 +218,7 @@ public class UsbDeviceConnection { * @param buffer buffer for data to send or receive * @param offset the index of the first byte in the buffer to send or receive * @param length the length of the data to send or receive - * @param timeout in milliseconds + * @param timeout in milliseconds, 0 is infinite * @return length of data transferred (or zero) for success, * or negative value for failure */ @@ -269,7 +270,7 @@ public class UsbDeviceConnection { private static void checkBounds(byte[] buffer, int start, int length) { final int bufferLength = (buffer != null ? buffer.length : 0); - if (start < 0 || start + length > bufferLength) { + if (length < 0 || start < 0 || start + length > bufferLength) { throw new IllegalArgumentException("Buffer start or length out of bounds."); } }