avoid possible null-pointer dereference in error-path

[hmcfgusb] / hmcfgusb.c

diff --git a/hmcfgusb.c b/hmcfgusb.c
index 90d741f347ab173b7abcfb1d1cc1f953b916e77e..83c9719b04b0d71e7324343a4aa75e7f147d3f87 100644 (file)
--- a/hmcfgusb.c
+++ b/hmcfgusb.c
@@ -223,7 +223,7 @@ static struct libusb_transfer *hmcfgusb_prepare_int(libusb_device_handle *devh,
        libusb_fill_interrupt_transfer(transfer, devh, EP_IN,
                        data_buf, in_size, cb, data, USB_TIMEOUT);
 
-       transfer->flags = LIBUSB_TRANSFER_SHORT_NOT_OK | LIBUSB_TRANSFER_FREE_BUFFER;
+       transfer->flags = LIBUSB_TRANSFER_FREE_BUFFER;
 
        err = libusb_submit_transfer(transfer);
        if (err != 0) {
@@ -285,8 +285,11 @@ static void LIBUSB_CALL hmcfgusb_interrupt(struct libusb_transfer *transfer)
        if (err != 0) {
                fprintf(stderr, "Can't re-submit transfer: %s\n", usb_strerror(err));
                libusb_free_transfer(transfer);
-               cb_data->dev->transfer = NULL;
-               free(cb_data);
+               if (cb_data) {
+                       if (cb_data->dev)
+                               cb_data->dev->transfer = NULL;
+                       free(cb_data);
+               }
        }
 }
 
@@ -345,11 +348,7 @@ struct hmcfgusb_dev *hmcfgusb_init(hmcfgusb_cb_fn cb, void *data)
        cb_data->cb = cb;
        cb_data->data = data;
 
-       /* Bootloader can only say ack/nack/done */
-       if (dev->bootloader)
-               dev->transfer = hmcfgusb_prepare_int(devh, hmcfgusb_interrupt, cb_data, 1);
-       else
-               dev->transfer = hmcfgusb_prepare_int(devh, hmcfgusb_interrupt, cb_data, ASYNC_SIZE);
+       dev->transfer = hmcfgusb_prepare_int(devh, hmcfgusb_interrupt, cb_data, ASYNC_SIZE);
 
        if (!dev->transfer) {
                fprintf(stderr, "Can't prepare async device io!\n");
@@ -437,13 +436,11 @@ int hmcfgusb_poll(struct hmcfgusb_dev *dev, int timeout)
                return -1;
        } else if (err == 0) {
                /* No pending timeout or a sane platform */
-               tv.tv_sec = timeout;
        } else {
                if ((tv.tv_sec == 0) && (tv.tv_usec == 0)) {
                        usb_event = 1;
-               } else if (tv.tv_sec > timeout) {
-                       tv.tv_sec = timeout;
-                       tv.tv_usec = 0;
+               } else if ((tv.tv_sec * 1000) < timeout) {
+                       timeout = tv.tv_sec * 1000;
                }
        }
 
@@ -452,7 +449,7 @@ int hmcfgusb_poll(struct hmcfgusb_dev *dev, int timeout)
                        dev->pfd[i].revents = 0;
                }
 
-               n = poll(dev->pfd, dev->n_pfd, tv.tv_sec * 1000);
+               n = poll(dev->pfd, dev->n_pfd, timeout);
                if (n < 0) {
                        perror("poll");
                        errno = 0;