mirror/tinyusb
3
0
Fork 0
mirror of https://github.com/hathach/tinyusb.git synced 2026-08-18 11:02:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

bound rndis data packet offset in handle_incoming_packet

Browse Source 
Signed-off-by: Javid Khan <dxbjavid@gmail.com>
This commit is contained in:
Javid Khan
2026-07-05 22:20:18 +05:30
parent 536157cb98
commit 0f61948954
1 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
src/class/net/ecm_rndis_device.c
View File

@ -324,8 +324,11 @@ static void handle_incoming_packet(uint32_t len) {
rndis_data_packet_t* r = (rndis_data_packet_t*)((void*)pnt);
if (len >= sizeof(rndis_data_packet_t)) {
if ((r->MessageType == REMOTE_NDIS_PACKET_MSG) && (r->MessageLength <= len)) {
if ((r->DataOffset + offsetof(rndis_data_packet_t, DataOffset) + r->DataLength) <= len) {
pnt = &_netd_epbuf.rx[r->DataOffset + offsetof(rndis_data_packet_t, DataOffset)];
// DataOffset and DataLength are host-controlled; validate the payload window fits
// within the received data without overflowing the uint32 addition (len >= header)
const uint32_t hdr = offsetof(rndis_data_packet_t, DataOffset);
if ((r->DataOffset <= len - hdr) && (r->DataLength <= len - hdr - r->DataOffset)) {
pnt = &_netd_epbuf.rx[hdr + r->DataOffset];
size = r->DataLength;
}
}