From beb341ae7f43a4424ca321315a25fe9133030de2 Mon Sep 17 00:00:00 2001 From: Andrew Scull Date: Sun, 3 Apr 2022 10:39:12 +0000 Subject: [PATCH] usb: sandbox: Bounds check read from buffer The buffer is 512 bytes but read requests can be 800 bytes. Limit the request to the size of the buffer. Signed-off-by: Andrew Scull Cc: Simon Glass Cc: Marek Vasut Reviewed-by: Simon Glass --- drivers/usb/emul/sandbox_flash.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/usb/emul/sandbox_flash.c b/drivers/usb/emul/sandbox_flash.c index edabc1b3..cc80f67 100644 --- a/drivers/usb/emul/sandbox_flash.c +++ b/drivers/usb/emul/sandbox_flash.c @@ -345,6 +345,8 @@ static int sandbox_flash_bulk(struct udevice *dev, struct usb_device *udev, } else { if (priv->alloc_len && len > priv->alloc_len) len = priv->alloc_len; + if (len > sizeof(priv->buff)) + len = sizeof(priv->buff); memcpy(buff, priv->buff, len); priv->phase = PHASE_STATUS; } -- 2.7.4