From owner-freebsd-usb@FreeBSD.ORG  Wed Jul 16 14:12:50 2008
Return-Path: <owner-freebsd-usb@FreeBSD.ORG>
Delivered-To: freebsd-usb@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 3252B106571C
	for <freebsd-usb@freebsd.org>; Wed, 16 Jul 2008 14:12:50 +0000 (UTC)
	(envelope-from hselasky@c2i.net)
Received: from swip.net (mailfe06.swip.net [212.247.154.161])
	by mx1.freebsd.org (Postfix) with ESMTP id C4FF98FC34
	for <freebsd-usb@freebsd.org>; Wed, 16 Jul 2008 14:12:49 +0000 (UTC)
	(envelope-from hselasky@c2i.net)
X-Cloudmark-Score: 0.000000 []
X-Cloudmark-Analysis: v=1.0 c=1 a=qnTVtq2nec8A:10 a=WCYNWLrA0c8A:10
	a=OD3o7pw0wSodp4EcQAYA:9 a=IdBI2fe2wbF4Zekz18spyBokfqcA:4
	a=LY0hPdMaydYA:10
Received: from [193.217.167.134] (account mc467741@c2i.net HELO [10.0.0.249])
	by mailfe06.swip.net (CommuniGate Pro SMTP 5.2.4b)
	with ESMTPA id 1009868322; Wed, 16 Jul 2008 16:12:48 +0200
From: Hans Petter Selasky <hselasky@c2i.net>
To: freebsd-usb@freebsd.org,
 Alexey Dokuchaev <danfe@nsu.ru>
Date: Wed, 16 Jul 2008 16:14:25 +0200
User-Agent: KMail/1.9.7
References: <200807161300.m6GD0A8a042062@freefall.freebsd.org>
In-Reply-To: <200807161300.m6GD0A8a042062@freefall.freebsd.org>
MIME-Version: 1.0
Content-Type: text/plain;
  charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
Message-Id: <200807161614.26974.hselasky@c2i.net>
Cc: 
Subject: Re: usb/117185: [umodem] [patch] Add support for UNION interface
	descriptor
X-BeenThere: freebsd-usb@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: FreeBSD support for USB <freebsd-usb.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-usb>,
	<mailto:freebsd-usb-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-usb>
List-Post: <mailto:freebsd-usb@freebsd.org>
List-Help: <mailto:freebsd-usb-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-usb>,
	<mailto:freebsd-usb-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 16 Jul 2008 14:12:50 -0000

On Wednesday 16 July 2008, Alexey Dokuchaev wrote:
> =A0+=A0=A0=A0=A0=A0=A0if (restart)
> =A0+=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0p =3D (uByte *)(restart) + =
restart->bLength;

Maybe you can add some extra range checks here. Remember the descriptors co=
me=20
from the device itself, and might be corrupt.

=2D-HPS