fixup! usbd_gs_can: USBD_GS_CAN_Config_Request(): check size

Allow bigger request length, if they fit in our buffer.
candle-usb · Dec 15, 2022 · 25726c4 · 25726c4
1 parent 343714f
commit 25726c4
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/src/usbd_gs_can.c b/src/usbd_gs_can.c
@@ -411,8 +411,12 @@ static uint8_t USBD_GS_CAN_Config_Request(USBD_HandleTypeDef *pdev, USBD_SetupRe
 		case GS_USB_BREQ_MODE:
 		case GS_USB_BREQ_IDENTIFY:
 		case GS_USB_BREQ_SET_TERMINATION:
+			if (req->wLength > sizeof(hcan->ep0_buf)) {
+				goto out_fail;
+			}
+
 			hcan->last_setup_request = *req;
-			USBD_CtlPrepareRx(pdev, hcan->ep0_buf, len);
+			USBD_CtlPrepareRx(pdev, hcan->ep0_buf, req->wLength);
 			break;
 
 		case GS_USB_BREQ_BT_CONST: