From 221ca8ef436f4f3f87c822ebc302c41e7304065d Mon Sep 17 00:00:00 2001
From: stefanrueger <stefan.rueger@urclocks.com>
Date: Fri, 14 Aug 2026 23:00:22 +0200
Subject: [PATCH] Fix buffer length curtailing

Thislen is the payload of the received data, which should not exceed the
buffer length minus 4 bytes header.
---
 src/jtag3.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/jtag3.c b/src/jtag3.c
index c7d7813f..16f91bfa 100644
--- a/src/jtag3.c
+++ b/src/jtag3.c
@@ -758,9 +758,9 @@ static int jtag3_edbg_recv_frame(const PROGRAMMER *pgm, unsigned char **msg) {
 
     int thislen = (buf[2] << 8) | buf[3];
 
-    if(thislen > rv + 4) {
-      pmsg_notice("%s(): unexpected length value (%d > %d)\n", __func__, thislen, rv + 4);
-      thislen = rv + 4;
+    if(thislen > rv - 4) {
+      pmsg_notice("%s(): unexpected length (%d > %d)\n", __func__, thislen, rv - 4);
+      thislen = rv - 4;
     }
     if(len + thislen > USBDEV_MAX_XFER_3) {
       pmsg_notice("%s(): length exceeds max size (%d > %d)\n", __func__, len + thislen, USBDEV_MAX_XFER_3);