diff options
| author | Andrew Scull <[email protected]> | 2022-04-03 10:39:12 +0000 |
|---|---|---|
| committer | Tom Rini <[email protected]> | 2022-04-29 11:11:36 -0400 |
| commit | beb341ae7f43a4424ca321315a25fe9133030de2 (patch) | |
| tree | d4711e35c4775e52f435e888abf03e16a8198bc2 | |
| parent | 62120155b67313509b673e051155075383a8a33a (diff) | |
usb: sandbox: Bounds check read from buffer
The buffer is 512 bytes but read requests can be 800 bytes. Limit the
request to the size of the buffer.
Signed-off-by: Andrew Scull <[email protected]>
Cc: Simon Glass <[email protected]>
Cc: Marek Vasut <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
| -rw-r--r-- | drivers/usb/emul/sandbox_flash.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/usb/emul/sandbox_flash.c b/drivers/usb/emul/sandbox_flash.c index edabc1b3a7a..cc80f671337 100644 --- a/drivers/usb/emul/sandbox_flash.c +++ b/drivers/usb/emul/sandbox_flash.c @@ -345,6 +345,8 @@ static int sandbox_flash_bulk(struct udevice *dev, struct usb_device *udev, } else { if (priv->alloc_len && len > priv->alloc_len) len = priv->alloc_len; + if (len > sizeof(priv->buff)) + len = sizeof(priv->buff); memcpy(buff, priv->buff, len); priv->phase = PHASE_STATUS; } |