Fix buffer overflow in versaloon interface

The USB buffer will need space for both TMS and TDI buffers.
Each holds tap_buffer_size bytes maximum, so tap_buffer_size must be
smaller than half of usb buf_size.

Change-Id: Id8f39936a894cbd98deb89eec5a859aef1e2b783
Signed-off-by: Joerg Fischer <turboj@gmx.de>
Reviewed-on: http://openocd.zylin.com/1136
Tested-by: jenkins
Reviewed-by: simon qian <simonqian.openocd@gmail.com>
Reviewed-by: Spencer Oliver <spen@spen-soft.co.uk>

diff --git a/src/jtag/drivers/vsllink.c b/src/jtag/drivers/vsllink.c
index 1c0c3e1eeed5bfc5bb7de3bef7a319a4d4a9e3bb..b9bda5d1e14e1ea574a52e12e105a18bd625c48b 100644 (file)
--- a/src/jtag/drivers/vsllink.c
+++ b/src/jtag/drivers/vsllink.c
@@ -302,7 +302,7 @@ static int vsllink_init(void)
        }
 
        /* malloc buffer size for tap */
        }
 
        /* malloc buffer size for tap */

-       tap_buffer_size = versaloon_interface.usb_setting.buf_size - 32;
+       tap_buffer_size = versaloon_interface.usb_setting.buf_size / 2 - 32;

        vsllink_free_buffer();
        tdi_buffer = (uint8_t *)malloc(tap_buffer_size);
        tdo_buffer = (uint8_t *)malloc(tap_buffer_size);
        vsllink_free_buffer();
        tdi_buffer = (uint8_t *)malloc(tap_buffer_size);
        tdo_buffer = (uint8_t *)malloc(tap_buffer_size);