diff options
| author |   mpi <mpi@openbsd.org> | 2013-05-17 09:09:11 +0000 |
|---|---|---|
| committer | mpi <mpi@openbsd.org> | 2013-05-17 09:09:11 +0000 |
| commit | ef75ed60fcb23d7c298d3bc70ca26d82a8b99f46 (patch) | |
| tree | 045befaaa2cda7a3d7f165b0caba2a82b68d208b /sys/dev/usb/usb.c | |
| parent | Move an extern declaration into its corresponding header file. (diff) | |
| download | wireguard-openbsd-ef75ed60fcb23d7c298d3bc70ca26d82a8b99f46.tar.xz wireguard-openbsd-ef75ed60fcb23d7c298d3bc70ca26d82a8b99f46.zip | |
Don't leak information to userland in case the actual transfer length is
smaller than the requested one. From ws@NetBSD via miod@.
This problem can only occur when the USBD_SHORT_XFER_OK flag is set,
otherwise completed transfers with a length smaller than the one
submitted are treated as errors.
ok miod@
Diffstat (limited to 'sys/dev/usb/usb.c')
| -rw-r--r-- | sys/dev/usb/usb.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/sys/dev/usb/usb.c b/sys/dev/usb/usb.c index 2ed661666d7..2054f207820 100644 --- a/sys/dev/usb/usb.c +++ b/sys/dev/usb/usb.c @@ -1,4 +1,4 @@ -/* $OpenBSD: usb.c,v 1.90 2013/04/26 14:05:24 mpi Exp $ */ +/* $OpenBSD: usb.c,v 1.91 2013/05/17 09:09:11 mpi Exp $ */ /* $NetBSD: usb.c,v 1.77 2003/01/01 00:10:26 thorpej Exp $ */ /* @@ -622,6 +622,9 @@ usbioctl(dev_t devt, u_long cmd, caddr_t data, int flag, struct proc *p) error = EIO; goto ret; } + /* Only if USBD_SHORT_XFER_OK is set. */ + if (len > ur->ucr_actlen) + len = ur->ucr_actlen; if (len != 0) { if (uio.uio_rw == UIO_READ) { error = uiomove(ptr, len, &uio); |