diff options
| author | Hans Petter Selasky <hselasky@FreeBSD.org> | 2019-06-25 13:15:29 +0000 |
|---|---|---|
| committer | Hans Petter Selasky <hselasky@FreeBSD.org> | 2019-06-25 13:15:29 +0000 |
| commit | 9efd65a9d280969c46be0b25e2d6a6ceca161ce0 (patch) | |
| tree | 6454e7acbb6f00237f10abda093e7fe51dbc103b | |
| parent | 59854ecf556f455aeaecfd540474afc8c277defe (diff) | |
| download | src-9efd65a9d280969c46be0b25e2d6a6ceca161ce0.tar.gz src-9efd65a9d280969c46be0b25e2d6a6ceca161ce0.zip | |
Fix parsing of corrupt data in usbdump(8). Check that the transfer
type array lookup is within bounds to avoid segfault.
PR: 238801
MFC after: 3 days
Sponsored by: Mellanox Technologies
Notes
Notes:
svn path=/head/; revision=349370
| -rw-r--r-- | usr.sbin/usbdump/usbdump.c | 15 |
1 files changed, 13 insertions, 2 deletions
diff --git a/usr.sbin/usbdump/usbdump.c b/usr.sbin/usbdump/usbdump.c index ef4476f55d8c..a38d08a252af 100644 --- a/usr.sbin/usbdump/usbdump.c +++ b/usr.sbin/usbdump/usbdump.c @@ -149,7 +149,9 @@ static const char *errstr_table[USB_ERR_MAX] = { [USB_ERR_NOT_LOCKED] = "NOT_LOCKED", }; -static const char *xfertype_table[4] = { +#define USB_XFERTYPE_MAX 4 + +static const char *xfertype_table[USB_XFERTYPE_MAX] = { [UE_CONTROL] = "CTRL", [UE_ISOCHRONOUS] = "ISOC", [UE_BULK] = "BULK", @@ -320,6 +322,15 @@ usb_speedstr(uint8_t speed) return (speed_table[speed]); } +static const char * +usb_xferstr(uint8_t type) +{ + if (type >= USB_XFERTYPE_MAX || xfertype_table[type] == NULL) + return ("UNKN"); + else + return (xfertype_table[type]); +} + static void print_flags(uint32_t flags) { @@ -496,7 +507,7 @@ print_apacket(const struct header_32 *hdr, const uint8_t *ptr, int ptr_len) (int)len, buf, tv.tv_usec, (int)up->up_busunit, (int)up->up_address, (up->up_type == USBPF_XFERTAP_SUBMIT) ? "SUBM" : "DONE", - xfertype_table[up->up_xfertype], + usb_xferstr(up->up_xfertype), (unsigned int)up->up_endpoint, usb_speedstr(up->up_speed), (int)up->up_frames, |