Merged in masayuki2009/nuttx.nuttx/fix_rndis (pull request #721)
drivers/usbdev: Fix buffer overrun check in rndis.c The rndis driver has been working since 13 Nov 2017. However, I finally found that it depends on network and buffer configurations. If a receiving TCP packet is devided into smaller ones based on USB max packet size, this condition check works correctly. Signed-off-by: Masayuki Ishikawa <Masayuki.Ishikawa@jp.sony.com> Approved-by: GregoryN <gnutt@nuttx.org>
This commit is contained in:
parent
913d013d8f
commit
03f5e8e5c2
|
@ -1249,7 +1249,7 @@ static inline int rndis_recvpacket(FAR struct rndis_dev_s *priv,
|
|||
|
||||
/* Check if the received packet exceeds request buffer */
|
||||
|
||||
if ((RNDIS_PACKET_HDR_SIZE + index + copysize) <= CONFIG_NET_ETH_PKTSIZE)
|
||||
if ((index + copysize) <= CONFIG_NET_ETH_PKTSIZE)
|
||||
{
|
||||
memcpy(&priv->rx_req->req->buf[RNDIS_PACKET_HDR_SIZE + index], reqbuf,
|
||||
copysize);
|
||||
|
|
Loading…
Reference in New Issue