diff options
| author | markus <markus@FreeBSD.org> | 2007-01-17 03:50:45 +0000 |
|---|---|---|
| committer | markus <markus@FreeBSD.org> | 2007-01-17 03:50:45 +0000 |
| commit | c778226d2fb5853db425faa7e982eb2549624c50 (patch) | |
| tree | 4fee407825c08edd5dc1a8e5c02e45194df633d7 /sys/dev/usb | |
| parent | 073fd8d86513737dc5e4b2b5cc4b17e6e3f14dd6 (diff) | |
| download | FreeBSD-src-c778226d2fb5853db425faa7e982eb2549624c50.zip FreeBSD-src-c778226d2fb5853db425faa7e982eb2549624c50.tar.gz | |
Fix a buffer overflow iff USB_DEBUG is set, hw.usb.ums.debug is > 5 and the
total size of all input reports is < 6.
PR: usb/106435
Submitted by: Eygene Ryabinkin <rea-fbsd@codelabs.ru>
Approved by: emax (mentor)
MFC after: 3 days
Diffstat (limited to 'sys/dev/usb')
| -rw-r--r-- | sys/dev/usb/ums.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/sys/dev/usb/ums.c b/sys/dev/usb/ums.c index d9392ce..e77d306 100644 --- a/sys/dev/usb/ums.c +++ b/sys/dev/usb/ums.c @@ -431,9 +431,10 @@ ums_intr(xfer, addr, status) #define UMS_BUT(i) ((i) < 3 ? (((i) + 2) % 3) : (i)) DPRINTFN(5, ("ums_intr: sc=%p status=%d\n", sc, status)); - DPRINTFN(5, ("ums_intr: data = %02x %02x %02x %02x %02x %02x\n", - sc->sc_ibuf[0], sc->sc_ibuf[1], sc->sc_ibuf[2], - sc->sc_ibuf[3], sc->sc_ibuf[4], sc->sc_ibuf[5])); + DPRINTFN(5, ("ums_intr: data =")); + for (i = 0; i < sc->sc_isize; i++) + DPRINTFN(5, (" %02x", sc->sc_ibuf[i])); + DPRINTFN(5, ("\n")); if (status == USBD_CANCELLED) return; |
