diff options
| author | Chris Kuethe <ckuethe@cvs.openbsd.org> | 2010-04-02 05:46:22 +0000 |
|---|---|---|
| committer | Chris Kuethe <ckuethe@cvs.openbsd.org> | 2010-04-02 05:46:22 +0000 |
| commit | 4eb1d20e369d5ca7a7f53ede62d50c263aaea0c0 (patch) | |
| tree | df9e6d4683a9384748cd0a3173f98a75198ccb98 | |
| parent | 5a360f4a40920b16ce5d68c8e95736dd57f2ce7d (diff) | |
Read description string length before reading description. From
Marcin Wyrwas in system/6338, tested with various ipods, usb drives
and smartphones. ok deraadt@
| -rw-r--r-- | usr.sbin/usbdevs/usbdevs.c | 12 |
1 files changed, 10 insertions, 2 deletions
diff --git a/usr.sbin/usbdevs/usbdevs.c b/usr.sbin/usbdevs/usbdevs.c index 701e58f5e4f..24af6e9b7ec 100644 --- a/usr.sbin/usbdevs/usbdevs.c +++ b/usr.sbin/usbdevs/usbdevs.c @@ -1,4 +1,4 @@ -/* $OpenBSD: usbdevs.c,v 1.17 2008/09/04 11:46:18 jsg Exp $ */ +/* $OpenBSD: usbdevs.c,v 1.18 2010/04/02 05:46:21 ckuethe Exp $ */ /* $NetBSD: usbdevs.c,v 1.19 2002/02/21 00:34:31 christos Exp $ */ /* @@ -205,7 +205,7 @@ getstring(int f, int addr, int si, char *s, int langid) req.ucr_data = &us; USETW2(req.ucr_request.wValue, UDESC_STRING, si); USETW(req.ucr_request.wIndex, langid); - USETW(req.ucr_request.wLength, sizeof(usb_string_descriptor_t)); + USETW(req.ucr_request.wLength, 2); req.ucr_flags = USBD_SHORT_XFER_OK; if (ioctl(f, USB_REQUEST, &req) == -1){ @@ -214,6 +214,14 @@ getstring(int f, int addr, int si, char *s, int langid) return; } + USETW(req.ucr_request.wLength, us.bLength); + + if (ioctl(f, USB_REQUEST, &req) == -1){ + perror("getstring: ioctl"); + *s = 0; + return; + } + n = us.bLength / 2 - 1; for (i = 0; i < n; i++) { c = UGETW(us.bString[i]); |