Closed hac425xxx closed 3 years ago
Thank you for pointing to this vulnerability. I think this can't be used as an exploit to extract key or protected data, but it can cause unpredictable behavior. Could you check PR?
No problems with this patch.
Closed with MR#36
The definition of the dfu_control function is as follows:
req
is receive from the external usb device.it's struct is as follows:
BUG:
for
USB_DFU_DNLOAD
case, ifreq->wLength > the sizeof req->data
, it could trigger buffer overflow indfu_dnload
.for
USB_DFU_UPLOAD
case, ifreq->wLength > the sizeof dev->status.data_ptr
, it could trigger buffer overflow indfu_upload
.