Date: Tue, 25 Jun 2019 13:15:30 +0000 (UTC) From: Hans Petter Selasky <hselasky@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r349370 - head/usr.sbin/usbdump Message-ID: <201906251315.x5PDFUXd082925@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: hselasky Date: Tue Jun 25 13:15:29 2019 New Revision: 349370 URL: https://svnweb.freebsd.org/changeset/base/349370 Log: Fix parsing of corrupt data in usbdump(8). Check that the transfer type array lookup is within bounds to avoid segfault. PR: 238801 MFC after: 3 days Sponsored by: Mellanox Technologies Modified: head/usr.sbin/usbdump/usbdump.c Modified: head/usr.sbin/usbdump/usbdump.c ============================================================================== --- head/usr.sbin/usbdump/usbdump.c Tue Jun 25 11:54:41 2019 (r349369) +++ head/usr.sbin/usbdump/usbdump.c Tue Jun 25 13:15:29 2019 (r349370) @@ -149,7 +149,9 @@ static const char *errstr_table[USB_ERR_MAX] = { [USB_ERR_NOT_LOCKED] = "NOT_LOCKED", }; -static const char *xfertype_table[4] = { +#define USB_XFERTYPE_MAX 4 + +static const char *xfertype_table[USB_XFERTYPE_MAX] = { [UE_CONTROL] = "CTRL", [UE_ISOCHRONOUS] = "ISOC", [UE_BULK] = "BULK", @@ -320,6 +322,15 @@ usb_speedstr(uint8_t speed) return (speed_table[speed]); } +static const char * +usb_xferstr(uint8_t type) +{ + if (type >= USB_XFERTYPE_MAX || xfertype_table[type] == NULL) + return ("UNKN"); + else + return (xfertype_table[type]); +} + static void print_flags(uint32_t flags) { @@ -496,7 +507,7 @@ print_apacket(const struct header_32 *hdr, const uint8 (int)len, buf, tv.tv_usec, (int)up->up_busunit, (int)up->up_address, (up->up_type == USBPF_XFERTAP_SUBMIT) ? "SUBM" : "DONE", - xfertype_table[up->up_xfertype], + usb_xferstr(up->up_xfertype), (unsigned int)up->up_endpoint, usb_speedstr(up->up_speed), (int)up->up_frames,
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201906251315.x5PDFUXd082925>