[PATCH 5/8] usb: sandbox: Bounds check read from buffer

From: Andrew Scull <ascull@google.com>
To: u-boot@lists.denx.de
Cc: sjg@chromium.org, seanga2@gmail.com,
	Andrew Scull <ascull@google.com>,  Marek Vasut <marex@denx.de>
Subject: [PATCH 5/8] usb: sandbox: Bounds check read from buffer
Date: Sun,  3 Apr 2022 10:39:12 +0000	[thread overview]
Message-ID: <20220403103915.3338027-6-ascull@google.com> (raw)
In-Reply-To: <20220403103915.3338027-1-ascull@google.com>

The buffer is 512 bytes but read requests can be 800 bytes. Limit the
request to the size of the buffer.

Signed-off-by: Andrew Scull <ascull@google.com>
Cc: Simon Glass <sjg@chromium.org>
Cc: Marek Vasut <marex@denx.de>
---
 drivers/usb/emul/sandbox_flash.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/emul/sandbox_flash.c b/drivers/usb/emul/sandbox_flash.c
index edabc1b3a7..cc80f67133 100644
--- a/drivers/usb/emul/sandbox_flash.c
+++ b/drivers/usb/emul/sandbox_flash.c
@@ -345,6 +345,8 @@ static int sandbox_flash_bulk(struct udevice *dev, struct usb_device *udev,
 			} else {
 				if (priv->alloc_len && len > priv->alloc_len)
 					len = priv->alloc_len;
+				if (len > sizeof(priv->buff))
+					len = sizeof(priv->buff);
 				memcpy(buff, priv->buff, len);
 				priv->phase = PHASE_STATUS;
 			}
-- 
2.35.1.1094.g7c7d902a7c-goog

