Blame SOURCES/Added-missing-length-check-in-urb_control_transfer.patch
|
 |
1069f6 |
From 8c513f127549433c830575202d1551b0e9dd182d Mon Sep 17 00:00:00 2001
|
|
|
1069f6 |
From: akallabeth <akallabeth@posteo.net>
|
|
|
1069f6 |
Date: Thu, 13 Oct 2022 09:00:48 +0200
|
|
|
1069f6 |
Subject: [PATCH] Added missing length check in urb_control_transfer
|
|
|
1069f6 |
|
|
|
1069f6 |
(cherry picked from commit ce838e2477cb8173ea5e98f35ad55ff41ea5117d)
|
|
|
1069f6 |
---
|
|
|
1069f6 |
channels/urbdrc/client/data_transfer.c | 4 ++++
|
|
|
1069f6 |
1 file changed, 4 insertions(+)
|
|
|
1069f6 |
|
|
|
1069f6 |
diff --git a/channels/urbdrc/client/data_transfer.c b/channels/urbdrc/client/data_transfer.c
|
|
|
1069f6 |
index 9a44e6e09..bb2784055 100644
|
|
|
1069f6 |
--- a/channels/urbdrc/client/data_transfer.c
|
|
|
1069f6 |
+++ b/channels/urbdrc/client/data_transfer.c
|
|
|
1069f6 |
@@ -673,7 +673,11 @@ static UINT urb_control_transfer(IUDEVICE* pdev, URBDRC_CHANNEL_CALLBACK* callba
|
|
|
1069f6 |
buffer = Stream_Pointer(out);
|
|
|
1069f6 |
|
|
|
1069f6 |
if (transferDir == USBD_TRANSFER_DIRECTION_OUT)
|
|
|
1069f6 |
+ {
|
|
|
1069f6 |
+ if (!Stream_CheckAndLogRequiredLength(TAG, s, OutputBufferSize))
|
|
|
1069f6 |
+ return ERROR_INVALID_DATA;
|
|
|
1069f6 |
Stream_Copy(s, out, OutputBufferSize);
|
|
|
1069f6 |
+ }
|
|
|
1069f6 |
|
|
|
1069f6 |
/** process TS_URB_CONTROL_TRANSFER */
|
|
|
1069f6 |
if (!pdev->control_transfer(pdev, RequestId, EndpointAddress, TransferFlags, bmRequestType,
|
|
|
1069f6 |
--
|
|
|
1069f6 |
2.37.1
|
|
|
1069f6 |
|