A pile of sizes to free(9). In test for a few days in snapshots.

Errors will result in nice clean panic messages so we know what's wrong.
Reviewed by dhill visa natano jsg.

1 files changed, 9 insertions, 8 deletions

diff --git a/sys/dev/usb/usb.c b/sys/dev/usb/usb.c
index e0d7992571c..21e4371c19c 100644
--- a/sys/dev/usb/usb.c
+++ b/sys/dev/usb/usb.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: usb.c,v 1.111 2016/05/18 18:28:58 patrick Exp $	*/
+/*	$OpenBSD: usb.c,v 1.112 2017/04/08 02:57:25 deraadt Exp $	*/
 /*	$NetBSD: usb.c,v 1.77 2003/01/01 00:10:26 thorpej Exp $	*/
 
 /*
@@ -610,10 +610,10 @@ usbioctl(dev_t devt, u_long cmd, caddr_t data, int flag, struct proc *p)
 	case USB_REQUEST:
 	{
 		struct usb_ctl_request *ur = (void *)data;
-		size_t len = UGETW(ur->ucr_request.wLength);
+		size_t len = UGETW(ur->ucr_request.wLength), mlen;
 		struct iovec iov;
 		struct uio uio;
-		void *ptr = 0;
+		void *ptr = NULL;
 		int addr = ur->ucr_addr;
 		usbd_status err;
 		int error = 0;
@@ -664,18 +664,19 @@ usbioctl(dev_t devt, u_long cmd, caddr_t data, int flag, struct proc *p)
 			goto ret;
 		}
 		/* Only if USBD_SHORT_XFER_OK is set. */
-		if (len > ur->ucr_actlen)
-			len = ur->ucr_actlen;
-		if (len != 0) {
+		mlen = len;
+		if (mlen > ur->ucr_actlen)
+			mlen = ur->ucr_actlen;
+		if (mlen != 0) {
 			if (uio.uio_rw == UIO_READ) {
-				error = uiomove(ptr, len, &uio);
+				error = uiomove(ptr, mlen, &uio);
 				if (error)
 					goto ret;
 			}
 		}
 	ret:
 		if (ptr)
-			free(ptr, M_TEMP, 0);
+			free(ptr, M_TEMP, len);
 		return (error);
 	}