@@ -1414,7 +1414,7 @@ static uint8_t USBD_CDC_RNDIS_ProcessQueryMsg(USBD_HandleTypeDef *pdev,
14141414 case OID_GEN_VENDOR_DESCRIPTION :
14151415 QueryResponse -> InfoBufLength = (strlen (USBD_CDC_RNDIS_VENDOR_DESC ) + 1U );
14161416 (void )USBD_memcpy (QueryResponse -> InfoBuf , USBD_CDC_RNDIS_VENDOR_DESC ,
1417- strlen (USBD_CDC_RNDIS_VENDOR_DESC ));
1417+ strlen (USBD_CDC_RNDIS_VENDOR_DESC ) + 1U );
14181418
14191419 QueryResponse -> Status = CDC_RNDIS_STATUS_SUCCESS ;
14201420 break ;
@@ -1452,7 +1452,7 @@ static uint8_t USBD_CDC_RNDIS_ProcessQueryMsg(USBD_HandleTypeDef *pdev,
14521452
14531453 case OID_GEN_CURRENT_PACKET_FILTER :
14541454 QueryResponse -> InfoBufLength = sizeof (uint32_t );
1455- QueryResponse -> InfoBuf [0 ] = 0xFFFFFFU ; /* USBD_CDC_RNDIS_DEVICE.packetFilter; */
1455+ QueryResponse -> InfoBuf [0 ] = 0xFFFFFFU ; /* USBD_CDC_RNDIS_DEVICE.packetFilter */
14561456 QueryResponse -> Status = CDC_RNDIS_STATUS_SUCCESS ;
14571457 break ;
14581458
@@ -1641,6 +1641,13 @@ static uint8_t USBD_CDC_RNDIS_ProcessPacketMsg(USBD_HandleTypeDef *pdev,
16411641 /* Use temporary storage variables to comply with MISRA-C 2012 rule of (+) operand allowed types */
16421642 tmp1 = (uint32_t )PacketMsg ;
16431643 tmp2 = (uint32_t )(PacketMsg -> DataOffset );
1644+
1645+ /* Validate DataOffset and DataLength against the received MsgLength */
1646+ if ((tmp2 + CDC_RNDIS_PCKTMSG_DATAOFFSET_OFFSET + PacketMsg -> DataLength ) > PacketMsg -> MsgLength )
1647+ {
1648+ return (uint8_t )USBD_FAIL ;
1649+ }
1650+
16441651 hcdc -> RxBuffer = (uint8_t * )(tmp1 + tmp2 + CDC_RNDIS_PCKTMSG_DATAOFFSET_OFFSET );
16451652 hcdc -> RxLength = PacketMsg -> DataLength ;
16461653
0 commit comments