When extracting transfer data, pay attention to the size of the buffer
provided by the user, which may be smaller than the length of data received in the transfer.
This commit is contained in:
10
usb/iso.c
10
usb/iso.c
@@ -74,8 +74,8 @@ int extract_data(struct libusb_transfer *xfer, void *raw, int max, unsigned char
|
|||||||
|
|
||||||
// Copy the data
|
// Copy the data
|
||||||
int len = pkt.actual_length;
|
int len = pkt.actual_length;
|
||||||
if (len > max) {
|
if (copied + len > max) {
|
||||||
len = max;
|
len = max - copied;
|
||||||
}
|
}
|
||||||
memcpy(out, in, len);
|
memcpy(out, in, len);
|
||||||
copied += len;
|
copied += len;
|
||||||
@@ -84,10 +84,14 @@ int extract_data(struct libusb_transfer *xfer, void *raw, int max, unsigned char
|
|||||||
in += pkt.length;
|
in += pkt.length;
|
||||||
out += len;
|
out += len;
|
||||||
|
|
||||||
|
if (copied == max) {
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
|
||||||
// Extract first error
|
// Extract first error
|
||||||
if (pkt.status == 0 || *status != 0) {
|
if (pkt.status == 0 || *status != 0) {
|
||||||
continue;
|
continue;
|
||||||
}
|
}
|
||||||
*status = pkt.status;
|
*status = pkt.status;
|
||||||
}
|
}
|
||||||
return copied;
|
return copied;
|
||||||
|
Reference in New Issue
Block a user