From ecb98f399d0a64296f42a75b65cfe36b9d7a39b0 Mon Sep 17 00:00:00 2001
From: sakumisu <1203593632@qq.com>
Date: Fri, 25 Jul 2025 22:37:25 +0800
Subject: [PATCH] update: add output_len param for usbh_get_string_desc

Signed-off-by: sakumisu <1203593632@qq.com>
---
 class/cdc/usbh_cdc_ecm.c        |  2 +-
 class/cdc/usbh_cdc_ncm.c        |  2 +-
 class/vendor/net/usbh_rtl8152.c |  4 ++--
 core/usbh_core.c                | 12 ++++++++----
 core/usbh_core.h                |  3 ++-
 5 files changed, 14 insertions(+), 9 deletions(-)

diff --git a/class/cdc/usbh_cdc_ecm.c b/class/cdc/usbh_cdc_ecm.c
index 094ea14f..73eaa430 100644
--- a/class/cdc/usbh_cdc_ecm.c
+++ b/class/cdc/usbh_cdc_ecm.c
@@ -121,7 +121,7 @@ get_mac:
     }
 
     memset(mac_buffer, 0, 12);
-    ret = usbh_get_string_desc(cdc_ecm_class->hport, mac_str_idx, (uint8_t *)mac_buffer);
+    ret = usbh_get_string_desc(cdc_ecm_class->hport, mac_str_idx, (uint8_t *)mac_buffer, 12);
     if (ret < 0) {
         return ret;
     }
diff --git a/class/cdc/usbh_cdc_ncm.c b/class/cdc/usbh_cdc_ncm.c
index b7c89f3d..2ee6e4ce 100644
--- a/class/cdc/usbh_cdc_ncm.c
+++ b/class/cdc/usbh_cdc_ncm.c
@@ -148,7 +148,7 @@ get_mac:
     }
 
     memset(mac_buffer, 0, 12);
-    ret = usbh_get_string_desc(cdc_ncm_class->hport, mac_str_idx, (uint8_t *)mac_buffer);
+    ret = usbh_get_string_desc(cdc_ncm_class->hport, mac_str_idx, (uint8_t *)mac_buffer, 12);
     if (ret < 0) {
         return ret;
     }
diff --git a/class/vendor/net/usbh_rtl8152.c b/class/vendor/net/usbh_rtl8152.c
index 145a9e78..39b59766 100644
--- a/class/vendor/net/usbh_rtl8152.c
+++ b/class/vendor/net/usbh_rtl8152.c
@@ -1121,7 +1121,7 @@ static inline int usb_ocp_write(struct usbh_rtl8152 *tp, uint16_t index, uint16_
 
 static uint32_t ocp_read_dword(struct usbh_rtl8152 *tp, uint16_t type, uint16_t index)
 {
-    uint32_t data;
+    uint32_t data = 0;
 
     generic_ocp_read(tp, index, sizeof(data), &data, type);
 
@@ -2050,7 +2050,7 @@ static int usbh_rtl8152_connect(struct usbh_hubport *hport, uint8_t intf)
     }
 
     memset(mac_buffer, 0, 12);
-    ret = usbh_get_string_desc(rtl8152_class->hport, 3, (uint8_t *)mac_buffer);
+    ret = usbh_get_string_desc(rtl8152_class->hport, 3, (uint8_t *)mac_buffer, 12);
     if (ret < 0) {
         return ret;
     }
diff --git a/core/usbh_core.c b/core/usbh_core.c
index 1339a292..9f23fdbe 100644
--- a/core/usbh_core.c
+++ b/core/usbh_core.c
@@ -514,7 +514,7 @@ int usbh_enumerate(struct usbh_hubport *hport)
 
     /* Get Manufacturer string */
     memset(string_buffer, 0, 128);
-    ret = usbh_get_string_desc(hport, USB_STRING_MFC_INDEX, string_buffer);
+    ret = usbh_get_string_desc(hport, USB_STRING_MFC_INDEX, string_buffer, 128);
     if (ret < 0) {
         USB_LOG_ERR("Failed to get Manufacturer string,errorcode:%d\r\n", ret);
         goto errout;
@@ -524,7 +524,7 @@ int usbh_enumerate(struct usbh_hubport *hport)
 
     /* Get Product string */
     memset(string_buffer, 0, 128);
-    ret = usbh_get_string_desc(hport, USB_STRING_PRODUCT_INDEX, string_buffer);
+    ret = usbh_get_string_desc(hport, USB_STRING_PRODUCT_INDEX, string_buffer, 128);
     if (ret < 0) {
         USB_LOG_ERR("Failed to get get Product string,errorcode:%d\r\n", ret);
         goto errout;
@@ -534,7 +534,7 @@ int usbh_enumerate(struct usbh_hubport *hport)
 
     /* Get SerialNumber string */
     memset(string_buffer, 0, 128);
-    ret = usbh_get_string_desc(hport, USB_STRING_SERIAL_INDEX, string_buffer);
+    ret = usbh_get_string_desc(hport, USB_STRING_SERIAL_INDEX, string_buffer, 128);
     if (ret < 0) {
         USB_LOG_ERR("Failed to get get SerialNumber string,errorcode:%d\r\n", ret);
         goto errout;
@@ -703,7 +703,7 @@ int usbh_control_transfer(struct usbh_hubport *hport, struct usb_setup_packet *s
     return ret;
 }
 
-int usbh_get_string_desc(struct usbh_hubport *hport, uint8_t index, uint8_t *output)
+int usbh_get_string_desc(struct usbh_hubport *hport, uint8_t index, uint8_t *output, uint16_t output_len)
 {
     struct usb_setup_packet *setup = hport->setup;
     int ret;
@@ -729,6 +729,10 @@ int usbh_get_string_desc(struct usbh_hubport *hport, uint8_t index, uint8_t *out
     dst = output;
     len = src[0];
 
+    if (((len - 2) / 2) > output_len) {
+        return -USB_ERR_NOMEM;
+    }
+
     while (i < len) {
         dst[j] = src[i];
         i += 2;
diff --git a/core/usbh_core.h b/core/usbh_core.h
index 6f4c2bb3..060c402e 100644
--- a/core/usbh_core.h
+++ b/core/usbh_core.h
@@ -255,9 +255,10 @@ int usbh_control_transfer(struct usbh_hubport *hport, struct usb_setup_packet *s
  * @param hport Pointer to the USB hub port structure.
  * @param index Index of the string descriptor to retrieve.
  * @param output Pointer to the buffer where the retrieved descriptor will be stored.
+ * @param output_len Length of the output buffer.
  * @return On success will return 0, and others indicate fail.
  */
-int usbh_get_string_desc(struct usbh_hubport *hport, uint8_t index, uint8_t *output);
+int usbh_get_string_desc(struct usbh_hubport *hport, uint8_t index, uint8_t *output, uint16_t output_len);
 
 /**
  * @brief Sets the alternate setting for a USB interface on a specific hub port.