Fix chrome.usb control transfer.

components/usb_service/usb_device_handle.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/usb_service/usb_device_handle.h"
 
 #include <algorithm>
 #include <vector>
 
 #include "base/message_loop/message_loop.h"
@@ skipping 216 matching lines @@
   scoped_refptr<net::IOBuffer> buffer = transfer.buffer;
   switch (transfer.transfer_type) {
     case USB_TRANSFER_CONTROL:
       // If the transfer is a control transfer we do not expose the control
       // setup header to the caller. This logic strips off the header if
       // present before invoking the callback provided with the transfer.
       if (actual_length > 0) {
         CHECK(transfer.length >= LIBUSB_CONTROL_SETUP_SIZE)
             << "buffer was not correctly set: too small for the control header";
 
-        if (transfer.length >= actual_length &&
-            actual_length >= LIBUSB_CONTROL_SETUP_SIZE) {
+        if (transfer.length >= (LIBUSB_CONTROL_SETUP_SIZE + actual_length))  {
           // If the payload is zero bytes long, pad out the allocated buffer
           // size to one byte so that an IOBuffer of that size can be allocated.
           scoped_refptr<net::IOBuffer> resized_buffer =
               new net::IOBuffer(static_cast<int>(
                   std::max(actual_length, static_cast<size_t>(1))));
           memcpy(resized_buffer->data(),
                  buffer->data() + LIBUSB_CONTROL_SETUP_SIZE,
                  actual_length);
           buffer = resized_buffer;
         }
@@ skipping 400 matching lines @@
   // Attempt-release all the interfaces.
   // It will be retained until the transfer cancellation is finished.
   claimed_interfaces_.clear();
 
   // Cannot close device handle here. Need to wait for libusb_cancel_transfer to
   // finish.
   device_ = NULL;
 }
 
 }  // namespace usb_service