diff options
| author |   ckuethe <ckuethe@openbsd.org> | 2010-04-02 05:46:21 +0000 |
|---|---|---|
| committer | ckuethe <ckuethe@openbsd.org> | 2010-04-02 05:46:21 +0000 |
| commit | acacac8f34603e0e4d5cc4ee6e300aff0936309c (patch) | |
| tree | 78fe6846704d601a716604445d427c5eba5a90de /usr.sbin/usbdevs | |
| parent | allow this to compile in the never-gonna-happen world without INET (diff) | |
| download | wireguard-openbsd-acacac8f34603e0e4d5cc4ee6e300aff0936309c.tar.xz wireguard-openbsd-acacac8f34603e0e4d5cc4ee6e300aff0936309c.zip | |
Read description string length before reading description. From
Marcin Wyrwas in system/6338, tested with various ipods, usb drives
and smartphones. ok deraadt@
Diffstat (limited to 'usr.sbin/usbdevs')
| -rw-r--r-- | usr.sbin/usbdevs/usbdevs.c | 12 |
1 files changed, 10 insertions, 2 deletions
diff --git a/usr.sbin/usbdevs/usbdevs.c b/usr.sbin/usbdevs/usbdevs.c index 701e58f5e4f..24af6e9b7ec 100644 --- a/usr.sbin/usbdevs/usbdevs.c +++ b/usr.sbin/usbdevs/usbdevs.c @@ -1,4 +1,4 @@ -/* $OpenBSD: usbdevs.c,v 1.17 2008/09/04 11:46:18 jsg Exp $ */ +/* $OpenBSD: usbdevs.c,v 1.18 2010/04/02 05:46:21 ckuethe Exp $ */ /* $NetBSD: usbdevs.c,v 1.19 2002/02/21 00:34:31 christos Exp $ */ /* @@ -205,7 +205,7 @@ getstring(int f, int addr, int si, char *s, int langid) req.ucr_data = &us; USETW2(req.ucr_request.wValue, UDESC_STRING, si); USETW(req.ucr_request.wIndex, langid); - USETW(req.ucr_request.wLength, sizeof(usb_string_descriptor_t)); + USETW(req.ucr_request.wLength, 2); req.ucr_flags = USBD_SHORT_XFER_OK; if (ioctl(f, USB_REQUEST, &req) == -1){ @@ -214,6 +214,14 @@ getstring(int f, int addr, int si, char *s, int langid) return; } + USETW(req.ucr_request.wLength, us.bLength); + + if (ioctl(f, USB_REQUEST, &req) == -1){ + perror("getstring: ioctl"); + *s = 0; + return; + } + n = us.bLength / 2 - 1; for (i = 0; i < n; i++) { c = UGETW(us.bString[i]); |