Skip site navigation (1)Skip section navigation (2)
Date:      Wed, 3 Jul 2019 18:19:29 +0000 (UTC)
From:      Hans Petter Selasky <hselasky@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-10@freebsd.org
Subject:   svn commit: r349666 - stable/10/usr.sbin/usbdump
Message-ID:  <201907031819.x63IJTcG024559@repo.freebsd.org>

next in thread | raw e-mail | index | archive | help
Author: hselasky
Date: Wed Jul  3 18:19:29 2019
New Revision: 349666
URL: https://svnweb.freebsd.org/changeset/base/349666

Log:
  MFC r349370:
  Fix parsing of corrupt data in usbdump(8). Check that the transfer
  type array lookup is within bounds to avoid segfault.
  
  PR:		238801
  Sponsored by:	Mellanox Technologies

Modified:
  stable/10/usr.sbin/usbdump/usbdump.c
Directory Properties:
  stable/10/   (props changed)

Modified: stable/10/usr.sbin/usbdump/usbdump.c
==============================================================================
--- stable/10/usr.sbin/usbdump/usbdump.c	Wed Jul  3 18:18:42 2019	(r349665)
+++ stable/10/usr.sbin/usbdump/usbdump.c	Wed Jul  3 18:19:29 2019	(r349666)
@@ -148,7 +148,9 @@ static const char *errstr_table[USB_ERR_MAX] = {
 	[USB_ERR_NOT_LOCKED]		= "NOT_LOCKED",
 };
 
-static const char *xfertype_table[4] = {
+#define	USB_XFERTYPE_MAX 4
+
+static const char *xfertype_table[USB_XFERTYPE_MAX] = {
 	[UE_CONTROL]			= "CTRL",
 	[UE_ISOCHRONOUS]		= "ISOC",
 	[UE_BULK]			= "BULK",
@@ -319,6 +321,15 @@ usb_speedstr(uint8_t speed)
 		return (speed_table[speed]);
 }
 
+static const char *
+usb_xferstr(uint8_t type)
+{
+	if (type >= USB_XFERTYPE_MAX  || xfertype_table[type] == NULL)
+		return ("UNKN");
+	else
+		return (xfertype_table[type]);
+}
+
 static void
 print_flags(uint32_t flags)
 {
@@ -495,7 +506,7 @@ print_apacket(const struct header_32 *hdr, const uint8
 		    (int)len, buf, tv.tv_usec,
 		    (int)up->up_busunit, (int)up->up_address,
 		    (up->up_type == USBPF_XFERTAP_SUBMIT) ? "SUBM" : "DONE",
-		    xfertype_table[up->up_xfertype],
+		    usb_xferstr(up->up_xfertype),
 		    (unsigned int)up->up_endpoint,
 		    usb_speedstr(up->up_speed),
 		    (int)up->up_frames,



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201907031819.x63IJTcG024559>