From 031eb5f9aaa6355795ae41edb1b05479262a48d2 Mon Sep 17 00:00:00 2001 From: akallabeth Date: Thu, 13 Aug 2020 13:51:38 +0200 Subject: [PATCH] Fixed short length for usb io control return. (cherry picked from commit 6f00308db78f27d6daee9a85ff3baec7cd8e8443) --- channels/urbdrc/client/data_transfer.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/channels/urbdrc/client/data_transfer.c b/channels/urbdrc/client/data_transfer.c index d67c33c..f33b0f3 100644 --- a/channels/urbdrc/client/data_transfer.c +++ b/channels/urbdrc/client/data_transfer.c @@ -242,7 +242,7 @@ static UINT urbdrc_process_io_control(IUDEVICE* pdev, URBDRC_CHANNEL_CALLBACK* c Stream_Read_UINT32(s, OutputBufferSize); Stream_Read_UINT32(s, RequestId); InterfaceId = ((STREAM_ID_PROXY << 30) | pdev->get_ReqCompletion(pdev)); - out = urb_create_iocompletion(InterfaceId, MessageId, RequestId, OutputBufferSize); + out = urb_create_iocompletion(InterfaceId, MessageId, RequestId, OutputBufferSize + 4); if (!out) return ERROR_OUTOFMEMORY; @@ -266,7 +266,11 @@ static UINT urbdrc_process_io_control(IUDEVICE* pdev, URBDRC_CHANNEL_CALLBACK* c if (success) { - Stream_Seek(out, OutputBufferSize); + if (!Stream_SafeSeek(out, OutputBufferSize)) + { + Stream_Free(out, TRUE); + return ERROR_INVALID_DATA; + } if (pdev->isExist(pdev) == 0) Stream_Write_UINT32(out, 0); -- 2.7.4