usb: dfu: check requested length (wLength) during DFU_UPLOAD

During DFU_UPLOAD, the host could requests more data
as stated in wTransferSize. Limit upload length to the
size of the request buffer (USB_REQUEST_BUFFER_SIZE).

Signed-off-by: Johann Fischer <j.fischer@phytec.de>
This commit is contained in:
Johann Fischer 2020-03-02 12:14:50 +01:00 committed by Johan Hedberg
commit 105849cf38

View file

@ -509,6 +509,15 @@ static int dfu_class_handle_req(struct usb_setup_packet *pSetup,
len = pSetup->wLength;
}
if (len > USB_DFU_MAX_XFER_SIZE) {
/*
* The host could requests more data as stated
* in wTransferSize. Limit upload length to the
* size of the request-buffer.
*/
len = USB_DFU_MAX_XFER_SIZE;
}
if (len) {
const struct flash_area *fa;