diff options
Diffstat (limited to 'channels/urbdrc')
| -rw-r--r-- | channels/urbdrc/client/data_transfer.c | 3 | ||||
| -rw-r--r-- | channels/urbdrc/client/libusb/libusb_udevice.c | 2 |
2 files changed, 4 insertions, 1 deletions
diff --git a/channels/urbdrc/client/data_transfer.c b/channels/urbdrc/client/data_transfer.c index 7a7e5a2..56f3267 100644 --- a/channels/urbdrc/client/data_transfer.c +++ b/channels/urbdrc/client/data_transfer.c @@ -705,7 +705,10 @@ static UINT urb_control_transfer(IUDEVICE* pdev, GENERIC_CHANNEL_CALLBACK* callb if (transferDir == USBD_TRANSFER_DIRECTION_OUT) { if (!Stream_CheckAndLogRequiredLength(TAG, s, OutputBufferSize)) + { + Stream_Free(out, TRUE); return ERROR_INVALID_DATA; + } Stream_Copy(s, out, OutputBufferSize); } diff --git a/channels/urbdrc/client/libusb/libusb_udevice.c b/channels/urbdrc/client/libusb/libusb_udevice.c index c226eb8..331adec 100644 --- a/channels/urbdrc/client/libusb/libusb_udevice.c +++ b/channels/urbdrc/client/libusb/libusb_udevice.c @@ -877,7 +877,7 @@ static UINT32 libusb_udev_control_query_device_text(IUDEVICE* idev, UINT32 TextT * not honor strings with multi '\0' characters well. */ const size_t rchar = _wcsnlen((WCHAR*)&data[2], sizeof(data) / 2); - len = MIN((BYTE)ret, slen); + len = MIN((BYTE)ret - 2, slen); len = MIN(len, inSize); len = MIN(len, rchar * 2 + sizeof(WCHAR)); memcpy(Buffer, &data[2], len); |