fix(core/usbh_core): Fix raw_config_desc heap out of bounds

cherry-embedded · Sep 16, 2024 · d0fac32 · d0fac32
1 parent e6fde5e
commit d0fac32
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/core/usbh_core.c b/core/usbh_core.c
@@ -486,7 +486,7 @@ int usbh_enumerate(struct usbh_hubport *hport)
         goto errout;
     }
     USB_LOG_INFO("The device has %d interfaces\r\n", ((struct usb_configuration_descriptor *)ep0_request_buffer[hport->bus->busid])->bNumInterfaces);
-    hport->raw_config_desc = usb_osal_malloc(wTotalLength);
+    hport->raw_config_desc = usb_osal_malloc(wTotalLength + 1);
     if (hport->raw_config_desc == NULL) {
         ret = -USB_ERR_NOMEM;
         USB_LOG_ERR("No memory to alloc for raw_config_desc\r\n");