mirror of
https://github.com/hathach/tinyusb.git
synced 2026-08-18 11:02:16 +00:00
fs_send_object() copied every received payload to f->data using only the running offset, so a host sending more data than its SendObjectInfo declared wrote past the object and overflowed fs_buf. Clamp each copy to what remains of f->size.