This is an automated email from the ASF dual-hosted git repository.
jerpelea pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/nuttx.git
The following commit(s) were added to refs/heads/master by this push:
new bfc6df0fdca drivers/usbdev: rndis: Reject truncated responses
bfc6df0fdca is described below
commit bfc6df0fdcac7d263727081ab6f417067d0c7a9d
Author: Old-Ding <[email protected]>
AuthorDate: Mon Jul 6 05:01:59 2026 +0800
drivers/usbdev: rndis: Reject truncated responses
When several RNDIS responses are queued, the control request handler sends
one complete response if the host wLength is smaller than the whole queue. If
the first queued response is also larger than wLength, copying hdr->msglen
bytes would overrun the requested transfer and the completion path would
consume a partial message.
Return EMSGSIZE before copying in that case so the queued response remains
intact for a retry with a large enough wLength.
Signed-off-by: Old-Ding <[email protected]>
---
drivers/usbdev/rndis.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/drivers/usbdev/rndis.c b/drivers/usbdev/rndis.c
index 1f2b385a7af..530de30b4d5 100644
--- a/drivers/usbdev/rndis.c
+++ b/drivers/usbdev/rndis.c
@@ -2615,7 +2615,16 @@ static int usbclass_setup(FAR struct
usbdevclass_driver_s *driver,
(struct rndis_response_header *)priv->response_queue;
ret = priv->response_queue_words * sizeof(uint32_t);
if (ret > len)
- ret = hdr->msglen;
+ {
+ if (hdr->msglen > len)
+ {
+ ret = -EMSGSIZE;
+ break;
+ }
+
+ ret = hdr->msglen;
+ }
+
memcpy(ctrlreq->buf, hdr, ret);
ctrlreq->priv = priv;
}
