diff options
| author | Ha Thach <[email protected]> | 2026-06-16 17:36:17 +0700 |
|---|---|---|
| committer | GitHub <[email protected]> | 2026-06-16 17:36:17 +0700 |
| commit | 7b791916a702c28f8f39e9bfc5eb8455d0942865 (patch) | |
| tree | d9e540eac87cb26beb5b14b2aa3d396993a2090e /src/class | |
| parent | 14e20e9f6b592d63bb18eb6fb36f1fd462f4f0a0 (diff) | |
device: clamp EP0 OUT data copy to the control transfer buffer (#3705)
* device: clamp EP0 OUT data copy to the control transfer buffer
usbd_control_xfer_cb() copied xferred_bytes from the EP0 bounce buffer
into the requester's buffer with no bound. A non-compliant host that
sends an OUT data packet larger than the control transfer's data_len
(= min(len, wLength), the buffer capacity) would overflow that buffer
and over-count total_xferred. Clamp xferred_bytes to the remaining
buffer space before the memcpy and accounting.
Diffstat (limited to 'src/class')
0 files changed, 0 insertions, 0 deletions