usb: mitigate the check of request buffer length (666fa318) · Commits · Wenxi XU / zephyr

subsys/usb/usb_device.c

+10 −4

Original line number	Diff line number	Diff line
		@@ -288,11 +288,17 @@ static void usb_handle_control_transfer(u8_t ep,

		length = sys_le16_to_cpu(setup->wLength);
		if (length > CONFIG_USB_REQUEST_BUFFER_SIZE) {
		if (REQTYPE_GET_DIR(setup->bmRequestType)
		== REQTYPE_DIR_TO_HOST) {
		/* Limit wLength */
		length = CONFIG_USB_REQUEST_BUFFER_SIZE;
		} else {
		LOG_ERR("Request buffer too small");
		usb_dc_ep_set_stall(USB_CONTROL_IN_EP0);
		usb_dc_ep_set_stall(USB_CONTROL_OUT_EP0);
		return;
		}
		}

		usb_dev.data_buf = usb_dev.req_data;
		usb_dev.data_buf_residue = length;