usb: sandbox: Bounds check read from buffer

[platform/kernel/u-boot.git] / drivers / usb / emul / sandbox_flash.c

diff --git a/drivers/usb/emul/sandbox_flash.c b/drivers/usb/emul/sandbox_flash.c
index edabc1b..cc80f67 100644 (file)
--- a/drivers/usb/emul/sandbox_flash.c
+++ b/drivers/usb/emul/sandbox_flash.c
@@ -345,6 +345,8 @@ static int sandbox_flash_bulk(struct udevice *dev, struct usb_device *udev,
                        } else {
                                if (priv->alloc_len && len > priv->alloc_len)
                                        len = priv->alloc_len;
+                               if (len > sizeof(priv->buff))
+                                       len = sizeof(priv->buff);
                                memcpy(buff, priv->buff, len);
                                priv->phase = PHASE_STATUS;
                        }