Moving the code in sloc203 (TRF7960A EVM firmware), originally for CCS into a form that would compile in IAR, I got a compiler warning on line 351 of file host.c "comparison always true". The line was: if(pos++ < 2 * BUF_LENGTH).
Sure enough, in line 215 of host.c the variable pos was declared as unsigned char, and in globals.h the symbol BUF_LENGTH was defined as 300 so the comparison WAS always true and the check for buffer overrun would fail. Changing pos to an unsigned int fixed the problem. The code should now actually accept no more than 600 nibbles/300 bytes, as appears to be intended.
Has no one tried to compile that code lately? An update to the package would seem to be in order. What code is actually in the EVM as supplied?