Author: hselasky
Date: Tue Jun 25 13:15:29 2019
New Revision: 349370
URL: https://svnweb.freebsd.org/changeset/base/349370
Log:
Fix parsing of corrupt data in usbdump(8). Check that the transfer
type array lookup is within bounds to avoid segfault.
PR: 238801
MFC after: 3 days
Sponsored by: Mellanox Technologies
Modified:
head/usr.sbin/usbdump/usbdump.c
Modified: head/usr.sbin/usbdump/usbdump.c
==============================================================================
--- head/usr.sbin/usbdump/usbdump.c Tue Jun 25 11:54:41 2019
(r349369)
+++ head/usr.sbin/usbdump/usbdump.c Tue Jun 25 13:15:29 2019
(r349370)
@@ -149,7 +149,9 @@ static const char *errstr_table[USB_ERR_MAX] = {
[USB_ERR_NOT_LOCKED] = "NOT_LOCKED",
};
-static const char *xfertype_table[4] = {
+#define USB_XFERTYPE_MAX 4
+
+static const char *xfertype_table[USB_XFERTYPE_MAX] = {
[UE_CONTROL] = "CTRL",
[UE_ISOCHRONOUS] = "ISOC",
[UE_BULK] = "BULK",
@@ -320,6 +322,15 @@ usb_speedstr(uint8_t speed)
return (speed_table[speed]);
}
+static const char *
+usb_xferstr(uint8_t type)
+{
+ if (type >= USB_XFERTYPE_MAX || xfertype_table[type] == NULL)
+ return ("UNKN");
+ else
+ return (xfertype_table[type]);
+}
+
static void
print_flags(uint32_t flags)
{
@@ -496,7 +507,7 @@ print_apacket(const struct header_32 *hdr, const uint8
(int)len, buf, tv.tv_usec,
(int)up->up_busunit, (int)up->up_address,
(up->up_type == USBPF_XFERTAP_SUBMIT) ? "SUBM" : "DONE",
- xfertype_table[up->up_xfertype],
+ usb_xferstr(up->up_xfertype),
(unsigned int)up->up_endpoint,
usb_speedstr(up->up_speed),
(int)up->up_frames,
_______________________________________________
svn-src-head@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
