From d9b00c01e09deea8d1255a89ce40174960aad793 Mon Sep 17 00:00:00 2001
From: Dario Nieuwenhuis <dirbaio@dirbaio.net>
Date: Mon, 6 Nov 2023 03:26:00 +0100
Subject: [PATCH] usb: reject instead of panic on CONTROL OUT longer than the
 buf.

---
 embassy-usb/src/lib.rs | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/embassy-usb/src/lib.rs b/embassy-usb/src/lib.rs
index 88d88cad7..9fc1e3320 100644
--- a/embassy-usb/src/lib.rs
+++ b/embassy-usb/src/lib.rs
@@ -406,6 +406,16 @@ impl<'d, D: Driver<'d>> UsbDevice<'d, D> {
         let max_packet_size = self.control.max_packet_size();
         let mut total = 0;
 
+        if req_length > self.control_buf.len() {
+            warn!(
+                "got CONTROL OUT with length {} higher than the control_buf len {}, rejecting.",
+                req_length,
+                self.control_buf.len()
+            );
+            self.control.reject().await;
+            return;
+        }
+
         let chunks = self.control_buf[..req_length].chunks_mut(max_packet_size);
         for (first, last, chunk) in first_last(chunks) {
             let size = match self.control.data_out(chunk, first, last).await {