Files
u-boot/drivers
Sean Anderson 24057fe0a8 sandbox: usb: Fix out-of-bounds read when fd=-1
sandbox_flash_bulk uses priv->read_len to determine if priv->buff contains
the response data (such as from SCSI_INQUIRY). However, if priv->fd=-1 in
handle_read, then priv->read_len is not set even though we are going to
PHASE_DATA. This causes sandbox_flash_bulk to try and read len bytes from
priv->buff, which likely goes past the end of the buffer. Fix this by always
setting priv->read_len even if we aren't going to read anything.

Fixes: f4f715360c ("dm: usb: sandbox: Add an emulator for USB flash devices")
Signed-off-by: Sean Anderson <seanga2@gmail.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
2022-06-28 03:09:51 +01:00
..
2022-04-25 09:25:00 +02:00
2022-05-02 09:58:13 -04:00
2022-06-23 13:12:55 -04:00
2022-06-24 14:16:00 +02:00
2022-06-20 14:40:59 -04:00
2021-10-05 08:50:15 -04:00
2022-01-13 07:57:49 -05:00
2022-06-20 14:40:59 -04:00
2022-04-28 09:26:44 -04:00
2022-06-20 14:40:59 -04:00
2022-01-13 07:57:49 -05:00
2022-06-20 14:40:59 -04:00
2022-06-23 13:12:56 -04:00
2022-06-08 14:00:22 -04:00
2022-05-02 09:58:13 -04:00
2022-05-03 21:39:22 +02:00
2021-10-01 21:08:18 -04:00