From 18526d78ebca223514fa39f28cd7603061ac6f58 Mon Sep 17 00:00:00 2001 From: Jukka Laitinen Date: Wed, 2 Oct 2024 12:49:58 +0300 Subject: [PATCH] drivers/usbdev/cdcacm.c: Set reqlen properly according to ep->maxpacket and CONFIG_CDCACM_BULKIN/OUT_REQLEN The request length may not exceed CONFIG_CDCACM_BULKIN_ lenghts, otherwise buffer overflow will occur Signed-off-by: Jukka Laitinen --- drivers/usbdev/cdcacm.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/usbdev/cdcacm.c b/drivers/usbdev/cdcacm.c index 13304d6dad7..e06b7ba19e0 100644 --- a/drivers/usbdev/cdcacm.c +++ b/drivers/usbdev/cdcacm.c @@ -327,7 +327,7 @@ static ssize_t cdcuart_sendbuf(FAR struct uart_dev_s *dev, /* Get the maximum number of bytes that will fit into one bulk IN request */ - reqlen = MAX(CONFIG_CDCACM_BULKIN_REQLEN, ep->maxpacket); + reqlen = MIN(CONFIG_CDCACM_BULKIN_REQLEN, ep->maxpacket); /* Peek at the request in the container at the head of the list */ @@ -500,7 +500,7 @@ static int cdcacm_requeue_rdrequest(FAR struct cdcacm_dev_s *priv, /* Requeue the read request */ ep = priv->epbulkout; - req->len = MAX(CONFIG_CDCACM_BULKOUT_REQLEN, ep->maxpacket); + req->len = MIN(CONFIG_CDCACM_BULKOUT_REQLEN, ep->maxpacket); ret = EP_SUBMIT(ep, req); if (ret != OK) { @@ -2664,7 +2664,7 @@ static void cdcuart_dmasend(FAR struct uart_dev_s *dev) /* Get the maximum number of bytes that will fit into one bulk IN request */ - reqlen = MAX(CONFIG_CDCACM_BULKIN_REQLEN, ep->maxpacket); + reqlen = MIN(CONFIG_CDCACM_BULKIN_REQLEN, ep->maxpacket); /* Peek at the request in the container at the head of the list */