Changing USB API buffer ownership.

chrome/browser/usb/usb_device.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/usb/usb_device.h"
 
 #include "base/stl_util.h"
 #include "base/synchronization/lock.h"
 #include "chrome/browser/usb/usb_service.h"
 #include "third_party/libusb/libusb.h"
@@ skipping 97 matching lines @@
   service_->CloseDevice(this);
   handle_ = NULL;
 }
 
 void UsbDevice::TransferComplete(PlatformUsbTransferHandle handle) {
   base::AutoLock lock(lock_);
 
   // TODO(gdk): Handle device disconnect.
   DCHECK(ContainsKey(transfers_, handle)) << "Missing transfer completed";
   Transfer* const transfer = &transfers_[handle];
-  if (transfer->buffer.get()) {
-    transfer->callback.Run(ConvertTransferStatus(handle->status));
+
+  // If the transfer is a control transfer we do not expose the control transfer
+  // setup header to the caller, this logic strips off the header from the
+  // buffer before invoking the callback provided with the transfer with it.
+  scoped_refptr<net::IOBuffer> buffer = transfer->buffer;
+  if (transfer->control_transfer) {
+    scoped_refptr<net::IOBuffer> resized_buffer = new net::IOBuffer(
+        handle->actual_length - LIBUSB_CONTROL_SETUP_SIZE);
+    memcpy(resized_buffer->data(), buffer->data() + LIBUSB_CONTROL_SETUP_SIZE,
+           handle->actual_length - LIBUSB_CONTROL_SETUP_SIZE);
+    buffer = resized_buffer;
+  } else {
+    // Clear the remainder of the response buffer. This prevents us from leaking
+    // uninitialized memory into the caller.
+    const size_t remainder = transfer->length - handle->actual_length;
+    memset(buffer->data() + handle->actual_length, 0, remainder);
   }
 
+  transfer->callback.Run(ConvertTransferStatus(handle->status), buffer,
+                         handle->actual_length);
+
   transfers_.erase(handle);
   libusb_free_transfer(handle);
 }
 
 void UsbDevice::ControlTransfer(const TransferDirection direction,
     const TransferRequestType request_type, const TransferRecipient recipient,
     const uint8 request, const uint16 value, const uint16 index,
     net::IOBuffer* buffer, const size_t length, const unsigned int timeout,
     const UsbTransferCallback& callback) {
   CheckDevice();
 
+  const size_t resized_length = LIBUSB_CONTROL_SETUP_SIZE + length;
   scoped_refptr<net::IOBuffer> resized_buffer(new net::IOBufferWithSize(
-      LIBUSB_CONTROL_SETUP_SIZE + length));
+      resized_length));
   memcpy(resized_buffer->data() + LIBUSB_CONTROL_SETUP_SIZE, buffer->data(),
          length);
 
   struct libusb_transfer* const transfer = libusb_alloc_transfer(0);
   const uint8 converted_type = CreateRequestType(direction, request_type,
                                                  recipient);
   libusb_fill_control_setup(reinterpret_cast<uint8*>(resized_buffer->data()),
                             converted_type, request, value, index, length);
   libusb_fill_control_transfer(transfer, handle_, reinterpret_cast<uint8*>(
       resized_buffer->data()), reinterpret_cast<libusb_transfer_cb_fn>(
           &HandleTransferCompletion), this, timeout);
-  SubmitTransfer(transfer, resized_buffer, callback);
+  SubmitTransfer(transfer, true, resized_buffer, resized_length, callback);
 }
 
 void UsbDevice::BulkTransfer(const TransferDirection direction,
     const uint8 endpoint, net::IOBuffer* buffer, const size_t length,
     const unsigned int timeout, const UsbTransferCallback& callback) {
   CheckDevice();
 
   struct libusb_transfer* const transfer = libusb_alloc_transfer(0);
   const uint8 new_endpoint = ConvertTransferDirection(direction) | endpoint;
   libusb_fill_bulk_transfer(transfer, handle_, new_endpoint,
       reinterpret_cast<uint8*>(buffer->data()), length,
       reinterpret_cast<libusb_transfer_cb_fn>(&HandleTransferCompletion), this,
       timeout);
-  SubmitTransfer(transfer, buffer, callback);
+  SubmitTransfer(transfer, false, buffer, length, callback);
 }
 
 void UsbDevice::InterruptTransfer(const TransferDirection direction,
     const uint8 endpoint, net::IOBuffer* buffer, const size_t length,
     const unsigned int timeout, const UsbTransferCallback& callback) {
   CheckDevice();
 
   struct libusb_transfer* const transfer = libusb_alloc_transfer(0);
   const uint8 new_endpoint = ConvertTransferDirection(direction) | endpoint;
   libusb_fill_interrupt_transfer(transfer, handle_, new_endpoint,
       reinterpret_cast<uint8*>(buffer->data()), length,
       reinterpret_cast<libusb_transfer_cb_fn>(&HandleTransferCompletion), this,
       timeout);
-  SubmitTransfer(transfer, buffer, callback);
+  SubmitTransfer(transfer, false, buffer, length, callback);
 }
 
 void UsbDevice::IsochronousTransfer(const TransferDirection direction,
     const uint8 endpoint, net::IOBuffer* buffer, const size_t length,
     const unsigned int packets, const unsigned int packet_length,
     const unsigned int timeout, const UsbTransferCallback& callback) {
   CheckDevice();
 
   const uint64 total_length = packets * packet_length;
   if (total_length > length) {
-    callback.Run(USB_TRANSFER_LENGTH_SHORT);
+    callback.Run(USB_TRANSFER_LENGTH_SHORT, NULL, 0);
     return;
   }
 
   struct libusb_transfer* const transfer = libusb_alloc_transfer(packets);
   const uint8 new_endpoint = ConvertTransferDirection(direction) | endpoint;
   libusb_fill_iso_transfer(transfer, handle_, new_endpoint,
       reinterpret_cast<uint8*>(buffer->data()), length, packets,
       reinterpret_cast<libusb_transfer_cb_fn>(&HandleTransferCompletion), this,
       timeout);
   libusb_set_iso_packet_lengths(transfer, packet_length);
 
-  SubmitTransfer(transfer, buffer, callback);
+  SubmitTransfer(transfer, false, buffer, length, callback);
 }
 
 void UsbDevice::CheckDevice() {
   DCHECK(handle_) << "Device is already closed.";
 }
 
 void UsbDevice::SubmitTransfer(PlatformUsbTransferHandle handle,
+                               bool control_transfer,
                                net::IOBuffer* buffer,
+                               const size_t length,
                                const UsbTransferCallback& callback) {
-  libusb_submit_transfer(handle);
-
   Transfer transfer;
+  transfer.control_transfer = control_transfer;
   transfer.buffer = buffer;
+  transfer.length = length;
   transfer.callback = callback;
 
   {
     base::AutoLock lock(lock_);
     transfers_[handle] = transfer;
+    libusb_submit_transfer(handle);
   }
 }