michaelh/zephyr
1
0
Fork 0
Code Releases Activity

usb: dfu: check requested length (wLength) during DFU_UPLOAD

Browse source 
During DFU_UPLOAD, the host could requests more data
as stated in wTransferSize. Limit upload length to the
size of the request buffer (USB_REQUEST_BUFFER_SIZE).

Signed-off-by: Johann Fischer <j.fischer@phytec.de>
This commit is contained in:
Johann Fischer 2020-03-02 12:14:50 +01:00 • committed by Johan Hedberg
commit 105849cf38
1 changed files with 9 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

9
subsys/usb/class/usb_dfu.c
View file

@ -509,6 +509,15 @@ static int dfu_class_handle_req(struct usb_setup_packet *pSetup,
len = pSetup->wLength;
}
if (len > USB_DFU_MAX_XFER_SIZE) {
/*
* The host could requests more data as stated
* in wTransferSize. Limit upload length to the
* size of the request-buffer.
*/
len = USB_DFU_MAX_XFER_SIZE;
}
if (len) {
const struct flash_area *fa;