diff options
| author |   jsg <jsg@openbsd.org> | 2007-04-09 08:42:55 +0000 |
|---|---|---|
| committer | jsg <jsg@openbsd.org> | 2007-04-09 08:42:55 +0000 |
| commit | 99b60cfecbd59796fe3c9976b280039294995d16 (patch) | |
| tree | 970b8524fbb667e9f5c8853baf64aa2008da72f0 | |
| parent | Add missing letoh16() for eeprom value. (diff) | |
| download | wireguard-openbsd-99b60cfecbd59796fe3c9976b280039294995d16.tar.xz wireguard-openbsd-99b60cfecbd59796fe3c9976b280039294995d16.zip | |
Remove any possibility of of an underflow happening when
pulling packets out of the usb buffer in rxeof.
Potential issue pointed out by Hans Petter Selasky <hselasky@c2i.net>
| -rw-r--r-- | sys/dev/usb/if_axe.c | 14 |
1 files changed, 9 insertions, 5 deletions
diff --git a/sys/dev/usb/if_axe.c b/sys/dev/usb/if_axe.c index 1ac8da580df..71ec9feeaae 100644 --- a/sys/dev/usb/if_axe.c +++ b/sys/dev/usb/if_axe.c @@ -1,4 +1,4 @@ -/* $OpenBSD: if_axe.c,v 1.61 2007/04/09 08:12:59 jsg Exp $ */ +/* $OpenBSD: if_axe.c,v 1.62 2007/04/09 08:42:55 jsg Exp $ */ /* * Copyright (c) 1997, 1998, 1999, 2000-2003 @@ -950,9 +950,6 @@ axe_rxeof(usbd_xfer_handle xfer, usbd_private_handle priv, usbd_status status) goto done; } - if ((pktlen % 2) != 0) - pktlen++; - buf += pktlen; memcpy(&hdr, buf, sizeof(hdr)); @@ -969,7 +966,14 @@ axe_rxeof(usbd_xfer_handle xfer, usbd_private_handle priv, usbd_status status) } buf += sizeof(hdr); - total_len -= pktlen + (pktlen % 2); + + if ((pktlen % 2) != 0) + pktlen++; + + if ((total_len - pktlen) < 0) + total_len = 0; + else + total_len -= pktlen; } else { pktlen = total_len; /* crc on the end? */ total_len = 0; |