kingkevin
/
esp32-s2_dfu
1
0
Fork 0
Code Issues Releases Activity

Merge pull request #1090 from szymonh/master 

Prevent buffer overflow in bth_device.c
This commit is contained in:
Ha Thach 2021-09-13 16:01:56 +07:00 committed by GitHub
parent 5013788989 50e3c0054f
commit 7e6f954ffe
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/class/bth/bth_device.c
View File

@ -214,14 +214,14 @@ bool btd_control_xfer_cb(uint8_t rhport, uint8_t stage, tusb_control_request_t c
} }
else return false; else return false;
return tud_control_xfer(rhport, request, &_btd_itf.hci_cmd, request->wLength); return tud_control_xfer(rhport, request, &_btd_itf.hci_cmd, sizeof(_btd_itf.hci_cmd));
} }
else if ( stage == CONTROL_STAGE_DATA ) else if ( stage == CONTROL_STAGE_DATA )
{ {
// Handle class request only // Handle class request only
TU_VERIFY(request->bmRequestType_bit.type == TUSB_REQ_TYPE_CLASS); TU_VERIFY(request->bmRequestType_bit.type == TUSB_REQ_TYPE_CLASS);
if (tud_bt_hci_cmd_cb) tud_bt_hci_cmd_cb(&_btd_itf.hci_cmd, request->wLength); if (tud_bt_hci_cmd_cb) tud_bt_hci_cmd_cb(&_btd_itf.hci_cmd, tu_min16(request->wLength, sizeof(_btd_itf.hci_cmd)));
} }
return true; return true;