From ad00133ca307099e7898c09a92d439f810a60bb4 Mon Sep 17 00:00:00 2001 From: Marius Greuel Date: Sat, 14 Apr 2018 15:05:26 +0200 Subject: [PATCH] Fix bug #54159, Buffer overflow in usbtiny.c --- usbtiny.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/usbtiny.c b/usbtiny.c index 4d6da196..0994bd36 100644 --- a/usbtiny.c +++ b/usbtiny.c @@ -641,6 +641,8 @@ static int usbtiny_paged_load (PROGRAMMER * pgm, AVRPART * p, AVRMEM* m, for (; addr < maxaddr; addr += chunk) { chunk = PDATA(pgm)->chunk_size; // start with the maximum chunk size possible + if (chunk > maxaddr - addr) + chunk = maxaddr - addr; // Send the chunk of data to the USBtiny with the function we want // to perform @@ -696,6 +698,8 @@ static int usbtiny_paged_write(PROGRAMMER * pgm, AVRPART * p, AVRMEM * m, for (; addr < maxaddr; addr += chunk) { // start with the max chunk size chunk = PDATA(pgm)->chunk_size; + if (chunk > maxaddr - addr) + chunk = maxaddr - addr; // we can only write a page at a time anyways if (m->paged && chunk > page_size)