d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

uath(4): Fix incorrect byte-swapping and a buffer length check.

Browse Source 
PR:			263638
Reported by:		Jeff Gibbons <jgibbons@protogate.com>
MFC after:		1 week
Sponsored by:		NVIDIA Networking
This commit is contained in:
Hans Petter Selasky 2022-04-30 11:21:54 +02:00
parent 00614c9c2d
commit 6eb6aeef7e
1 changed files with 3 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
sys/dev/usb/wlan/if_uath.c
View File

@ -2244,7 +2244,7 @@ uath_cmdeof(struct uath_softc *sc, struct uath_cmd *cmd)
u_int olen;
if (sizeof(*hdr) > hdr->len ||
hdr->len >= UATH_MAX_CMDSZ) {
hdr->len > UATH_MAX_CMDSZ) {
device_printf(sc->sc_dev,
"%s: invalid WDC msg length %u; "
"msg ignored\n", __func__, hdr->len);
@ -2360,11 +2360,10 @@ uath_intr_rx_callback(struct usb_xfer *xfer, usb_error_t error)
usbd_copy_out(pc, 0, cmd->buf, actlen);
hdr = (struct uath_cmd_hdr *)cmd->buf;
hdr->len = be32toh(hdr->len);
if (hdr->len > (uint32_t)actlen) {
if (be32toh(hdr->len) > (uint32_t)actlen) {
device_printf(sc->sc_dev,
"%s: truncated xfer (len %u, actlen %d)\n",
__func__, hdr->len, actlen);
__func__, be32toh(hdr->len), actlen);
goto setup;
}