From e3596595b86ea27c38de4ecf47045f989cea039a Mon Sep 17 00:00:00 2001 From: Armin Novak Date: Mon, 28 Sep 2026 10:41:18 +0200 Subject: [PATCH] [channels,urbdrc] fix missing input range check --- channels/urbdrc/client/libusb/libusb_udevice.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/channels/urbdrc/client/libusb/libusb_udevice.c b/channels/urbdrc/client/libusb/libusb_udevice.c index be7da31b71ce..793138add6e2 100644 --- a/channels/urbdrc/client/libusb/libusb_udevice.c +++ b/channels/urbdrc/client/libusb/libusb_udevice.c @@ -1545,14 +1545,16 @@ static int libusb_udev_bulk_or_interrupt_transfer( UDEVICE* pdev = (UDEVICE*)idev; const LIBUSB_ENDPOINT_DESCEIPTOR* ep_desc = nullptr; struct libusb_transfer* transfer = nullptr; - URBDRC_PLUGIN* urbdrc = nullptr; ASYNC_TRANSFER_USER_DATA* user_data = nullptr; uint32_t streamID = 0x80000000 | RequestId; if (!pdev || !pdev->LibusbConfig || !pdev->urbdrc) return -1; - urbdrc = pdev->urbdrc; + if (BufferSize > INT32_MAX) + return -1; + + URBDRC_PLUGIN* urbdrc = pdev->urbdrc; user_data = async_transfer_user_data_new(idev, MessageId, 36, BufferSize, data, 0, NoAck, transferDir, cb, callback);