Skip site navigation (1)Skip section navigation (2)
Date:      Wed, 3 Jul 2019 18:18:43 +0000 (UTC)
From:      Hans Petter Selasky <hselasky@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-11@freebsd.org
Subject:   svn commit: r349665 - stable/11/usr.sbin/usbdump
Message-ID:  <201907031818.x63IIha8024456@repo.freebsd.org>

next in thread | raw e-mail | index | archive | help
Author: hselasky
Date: Wed Jul  3 18:18:42 2019
New Revision: 349665
URL: https://svnweb.freebsd.org/changeset/base/349665

Log:
  MFC r349370:
  Fix parsing of corrupt data in usbdump(8). Check that the transfer
  type array lookup is within bounds to avoid segfault.
  
  PR:		238801
  Sponsored by:	Mellanox Technologies

Modified:
  stable/11/usr.sbin/usbdump/usbdump.c
Directory Properties:
  stable/11/   (props changed)

Modified: stable/11/usr.sbin/usbdump/usbdump.c
==============================================================================
--- stable/11/usr.sbin/usbdump/usbdump.c	Wed Jul  3 18:18:05 2019	(r349664)
+++ stable/11/usr.sbin/usbdump/usbdump.c	Wed Jul  3 18:18:42 2019	(r349665)
@@ -149,7 +149,9 @@ static const char *errstr_table[USB_ERR_MAX] = {
 	[USB_ERR_NOT_LOCKED]		= "NOT_LOCKED",
 };
 
-static const char *xfertype_table[4] = {
+#define	USB_XFERTYPE_MAX 4
+
+static const char *xfertype_table[USB_XFERTYPE_MAX] = {
 	[UE_CONTROL]			= "CTRL",
 	[UE_ISOCHRONOUS]		= "ISOC",
 	[UE_BULK]			= "BULK",
@@ -320,6 +322,15 @@ usb_speedstr(uint8_t speed)
 		return (speed_table[speed]);
 }
 
+static const char *
+usb_xferstr(uint8_t type)
+{
+	if (type >= USB_XFERTYPE_MAX  || xfertype_table[type] == NULL)
+		return ("UNKN");
+	else
+		return (xfertype_table[type]);
+}
+
 static void
 print_flags(uint32_t flags)
 {
@@ -496,7 +507,7 @@ print_apacket(const struct header_32 *hdr, const uint8
 		    (int)len, buf, tv.tv_usec,
 		    (int)up->up_busunit, (int)up->up_address,
 		    (up->up_type == USBPF_XFERTAP_SUBMIT) ? "SUBM" : "DONE",
-		    xfertype_table[up->up_xfertype],
+		    usb_xferstr(up->up_xfertype),
 		    (unsigned int)up->up_endpoint,
 		    usb_speedstr(up->up_speed),
 		    (int)up->up_frames,



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201907031818.x63IIha8024456>