usb: dfu: check requested length (wLength) during DFU_UPLOAD
During DFU_UPLOAD, the host could requests more data as stated in wTransferSize. Limit upload length to the size of the request buffer (USB_REQUEST_BUFFER_SIZE). Signed-off-by: Johann Fischer <j.fischer@phytec.de>
This commit is contained in:
parent
5372e78827
commit
105849cf38
1 changed files with 9 additions and 0 deletions
|
@ -509,6 +509,15 @@ static int dfu_class_handle_req(struct usb_setup_packet *pSetup,
|
|||
len = pSetup->wLength;
|
||||
}
|
||||
|
||||
if (len > USB_DFU_MAX_XFER_SIZE) {
|
||||
/*
|
||||
* The host could requests more data as stated
|
||||
* in wTransferSize. Limit upload length to the
|
||||
* size of the request-buffer.
|
||||
*/
|
||||
len = USB_DFU_MAX_XFER_SIZE;
|
||||
}
|
||||
|
||||
if (len) {
|
||||
const struct flash_area *fa;
|
||||
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue