From a35725f4fb2f9ed3dd3be290770f0e649937f7ed Mon Sep 17 00:00:00 2001 From: Sebastian Zagrodzki Date: Wed, 8 Feb 2017 22:37:12 +0100 Subject: [PATCH] When extracting transfer data, pay attention to the size of the buffer provided by the user, which may be smaller than the length of data received in the transfer. --- usb/iso.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/usb/iso.c b/usb/iso.c index 1204eb7..7cd4dd0 100644 --- a/usb/iso.c +++ b/usb/iso.c @@ -74,8 +74,8 @@ int extract_data(struct libusb_transfer *xfer, void *raw, int max, unsigned char // Copy the data int len = pkt.actual_length; - if (len > max) { - len = max; + if (copied + len > max) { + len = max - copied; } memcpy(out, in, len); copied += len; @@ -84,10 +84,14 @@ int extract_data(struct libusb_transfer *xfer, void *raw, int max, unsigned char in += pkt.length; out += len; + if (copied == max) { + break; + } + // Extract first error if (pkt.status == 0 || *status != 0) { continue; - } + } *status = pkt.status; } return copied;