This is an automated email from the ASF dual-hosted git repository.
xiaoxiang781216 pushed a commit to branch releases/13.0
in repository https://gitbox.apache.org/repos/asf/nuttx.git
The following commit(s) were added to refs/heads/releases/13.0 by this push:
new 6989e89eded drivers/usbdev: rndis: Reject truncated responses
6989e89eded is described below
commit 6989e89eded433849eb74f4f52d425cd915a8f50
Author: Old-Ding <[email protected]>
AuthorDate: Mon Jul 6 05:01:59 2026 +0800
drivers/usbdev: rndis: Reject truncated responses
When several RNDIS responses are queued, the control request handler sends
one complete response if the host wLength is smaller than the whole queue. If
the first queued response is also larger than wLength, copying hdr->msglen
bytes would overrun the requested transfer and the completion path would
consume a partial message.
Return EMSGSIZE before copying in that case so the queued response remains
intact for a retry with a large enough wLength.
Signed-off-by: Old-Ding <[email protected]>
---
drivers/usbdev/rndis.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/drivers/usbdev/rndis.c b/drivers/usbdev/rndis.c
index 1f2b385a7af..530de30b4d5 100644
--- a/drivers/usbdev/rndis.c
+++ b/drivers/usbdev/rndis.c
@@ -2615,7 +2615,16 @@ static int usbclass_setup(FAR struct
usbdevclass_driver_s *driver,
(struct rndis_response_header *)priv->response_queue;
ret = priv->response_queue_words * sizeof(uint32_t);
if (ret > len)
- ret = hdr->msglen;
+ {
+ if (hdr->msglen > len)
+ {
+ ret = -EMSGSIZE;
+ break;
+ }
+
+ ret = hdr->msglen;
+ }
+
memcpy(ctrlreq->buf, hdr, ret);
ctrlreq->priv = priv;
}
