Author: hselasky
Date: Wed Jul 3 18:19:29 2019
New Revision: 349666
URL: https://svnweb.freebsd.org/changeset/base/349666
Log:
MFC r349370:
Fix parsing of corrupt data in usbdump(8). Check that the transfer
type array lookup is within bounds to avoid segfault.
PR: 238801
Sponsored by: Mellanox Technologies
Modified:
stable/10/usr.sbin/usbdump/usbdump.c
Directory Properties:
stable/10/ (props changed)
Modified: stable/10/usr.sbin/usbdump/usbdump.c
==============================================================================
--- stable/10/usr.sbin/usbdump/usbdump.c Wed Jul 3 18:18:42 2019
(r349665)
+++ stable/10/usr.sbin/usbdump/usbdump.c Wed Jul 3 18:19:29 2019
(r349666)
@@ -148,7 +148,9 @@ static const char *errstr_table[USB_ERR_MAX] = {
[USB_ERR_NOT_LOCKED] = "NOT_LOCKED",
};
-static const char *xfertype_table[4] = {
+#define USB_XFERTYPE_MAX 4
+
+static const char *xfertype_table[USB_XFERTYPE_MAX] = {
[UE_CONTROL] = "CTRL",
[UE_ISOCHRONOUS] = "ISOC",
[UE_BULK] = "BULK",
@@ -319,6 +321,15 @@ usb_speedstr(uint8_t speed)
return (speed_table[speed]);
}
+static const char *
+usb_xferstr(uint8_t type)
+{
+ if (type >= USB_XFERTYPE_MAX || xfertype_table[type] == NULL)
+ return ("UNKN");
+ else
+ return (xfertype_table[type]);
+}
+
static void
print_flags(uint32_t flags)
{
@@ -495,7 +506,7 @@ print_apacket(const struct header_32 *hdr, const uint8
(int)len, buf, tv.tv_usec,
(int)up->up_busunit, (int)up->up_address,
(up->up_type == USBPF_XFERTAP_SUBMIT) ? "SUBM" : "DONE",
- xfertype_table[up->up_xfertype],
+ usb_xferstr(up->up_xfertype),
(unsigned int)up->up_endpoint,
usb_speedstr(up->up_speed),
(int)up->up_frames,
_______________________________________________
svn-src-stable-10@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-stable-10
To unsubscribe, send any mail to "svn-src-stable-10-unsubscr...@freebsd.org"
