@@ -89,10 +89,18 @@ void vmem_server_handler(csp_conn_t * conn)
8989
9090 uint64_t length ;
9191 uint64_t address ;
92+ uint16_t mtu = VMEM_SERVER_MTU ;
93+ const uint16_t mtu_max = CSP_BUFFER_SIZE - sizeof (csp_crc32_t ) - 5 ; /* 5 bytes for RDP header */
9294
9395 if (request -> version == 3 ) {
9496 address = be64toh (request -> data3 .address );
9597 length = be64toh (request -> data3 .length );
98+ if (packet -> length > offsetof(vmem_request_t , data3 .mtu )) {
99+ mtu = be16toh (request -> data3 .mtu );
100+ if (mtu == 0 || mtu > CSP_BUFFER_SIZE ) {
101+ mtu = CSP_BUFFER_SIZE ;
102+ }
103+ }
96104 } else if (request -> version == 2 ) {
97105 address = be64toh (request -> data2 .address );
98106 length = be32toh (request -> data2 .length );
@@ -101,6 +109,10 @@ void vmem_server_handler(csp_conn_t * conn)
101109 length = be32toh (request -> data .length );
102110 }
103111
112+ if (mtu > mtu_max ) {
113+ mtu = mtu_max ;
114+ }
115+
104116 //printf("Download from:");
105117 //printf(" Addr %"PRIx64"\n", address);
106118 //printf(" Length %"PRIu32"\n", length);
@@ -114,11 +126,11 @@ void vmem_server_handler(csp_conn_t * conn)
114126
115127 while ((count < length ) && csp_conn_is_active (conn )) {
116128 /* Prepare packet */
117- csp_packet_t * packet = csp_buffer_get (VMEM_SERVER_MTU );
129+ csp_packet_t * packet = csp_buffer_get (mtu );
118130 if (packet == NULL ) {
119131 break ;
120132 }
121- packet -> length = VMEM_MIN (VMEM_SERVER_MTU , length - count );
133+ packet -> length = VMEM_MIN (mtu , length - count );
122134
123135 /* Get data */
124136 vmem_read (packet -> data , address + count , packet -> length );
@@ -131,7 +143,7 @@ void vmem_server_handler(csp_conn_t * conn)
131143 } else if (type == VMEM_SERVER_CALCULATE_CRC32 ) {
132144
133145 /* Do the CRC32 calculation on the address area (vmem) using the request packet as the buffer */
134- uint32_t crc = vmem_calc_crc32 (address , length , & packet -> data [0 ], VMEM_SERVER_MTU );
146+ uint32_t crc = vmem_calc_crc32 (address , length , & packet -> data [0 ], mtu );
135147
136148 /* Convert to network byte order */
137149 crc = htobe32 (crc );
0 commit comments