diff --git a/src/usbd_gs_can.c b/src/usbd_gs_can.c
index 40256530..90b07d62 100644
--- a/src/usbd_gs_can.c
+++ b/src/usbd_gs_can.c
@@ -411,8 +411,12 @@ static uint8_t USBD_GS_CAN_Config_Request(USBD_HandleTypeDef *pdev, USBD_SetupRe
 		case GS_USB_BREQ_MODE:
 		case GS_USB_BREQ_IDENTIFY:
 		case GS_USB_BREQ_SET_TERMINATION:
+			if (req->wLength > sizeof(hcan->ep0_buf)) {
+				goto out_fail;
+			}
+
 			hcan->last_setup_request = *req;
-			USBD_CtlPrepareRx(pdev, hcan->ep0_buf, len);
+			USBD_CtlPrepareRx(pdev, hcan->ep0_buf, req->wLength);
 			break;
 
 		case GS_USB_BREQ_BT_CONST: