fix buffer overflow bug

hathach · Dec 6, 2023 · 9dfc5fe · 9dfc5fe
1 parent a1ae2a3
commit 9dfc5fe
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/src/portable/wch/ch32v20x/dcd_usbfs.c b/src/portable/wch/ch32v20x/dcd_usbfs.c
@@ -74,8 +74,8 @@ static void update_in(uint8_t rhport, uint8_t ep, bool force) {
 static void update_out(uint8_t rhport, uint8_t ep, size_t rx_len) {
     struct usb_xfer *xfer = &data.xfer[ep][TUSB_DIR_OUT];
     if (xfer->valid) {
-        size_t len = TU_MIN(xfer->len, rx_len);
-        memcpy(xfer->buffer, data.buffer[ep][TUSB_DIR_OUT], rx_len);
+        size_t len = TU_MIN(xfer->max_size, TU_MIN(xfer->len, rx_len));
+        memcpy(xfer->buffer, data.buffer[ep][TUSB_DIR_OUT], len);
         xfer->buffer += len;
         xfer->len -= len;
         xfer->processed_len += len;