[multiple] Fix crashes from malformed external input (batch 2) (#14651)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Jonathan Swoboda
2026-03-09 17:20:09 -04:00
committed by GitHub
co-authored by Claude Opus 4.6
parent 9418f35cc3
commit fecedeb018
6 changed files with 46 additions and 1 deletions
@@ -492,6 +492,11 @@ bool USBClient::transfer_in(uint8_t ep_address, const transfer_cb_t &callback, u
ESP_LOGE(TAG, "Too many requests queued");
return false;
}
if (length > trq->transfer->data_buffer_size) {
ESP_LOGE(TAG, "transfer_in: data length %u exceeds buffer size %u", length, trq->transfer->data_buffer_size);
this->release_trq(trq);
return false;
}
trq->callback = callback;
trq->transfer->callback = transfer_callback;
trq->transfer->bEndpointAddress = ep_address | USB_DIR_IN;