Aksal/nuttx
3
1
Fork 1
mirror of https://github.com/apache/nuttx.git synced 2026-08-01 20:28:58 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

drivers/usbdev: rndis: Reject truncated responses

Browse source 
When several RNDIS responses are queued, the control request handler sends one complete response if the host wLength is smaller than the whole queue. If the first queued response is also larger than wLength, copying hdr->msglen bytes would overrun the requested transfer and the completion path would consume a partial message.

Return EMSGSIZE before copying in that case so the queued response remains intact for a retry with a large enough wLength.

Signed-off-by: Old-Ding <35417409+Old-Ding@users.noreply.github.com>
This commit is contained in:
Old-Ding 2026-07-06 05:01:59 +08:00 • committed by Xiang Xiao
parent 1d7d5d3f13
commit 6989e89ede
1 changed files with 10 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

11
drivers/usbdev/rndis.c
View file

@ -2615,7 +2615,16 @@ static int usbclass_setup(FAR struct usbdevclass_driver_s *driver,
(struct rndis_response_header *)priv->response_queue;
ret = priv->response_queue_words * sizeof(uint32_t);
if (ret > len)
ret = hdr->msglen;
{
if (hdr->msglen > len)
{
ret = -EMSGSIZE;
break;
}
ret = hdr->msglen;
}
memcpy(ctrlreq->buf, hdr, ret);
ctrlreq->priv = priv;
}