diff options
| author | Martin Pieuchot <mpi@cvs.openbsd.org> | 2013-05-17 09:09:12 +0000 |
|---|---|---|
| committer | Martin Pieuchot <mpi@cvs.openbsd.org> | 2013-05-17 09:09:12 +0000 |
| commit | d765da51bd2fca90693f6a9b3959f4612e5c0db6 (patch) | |
| tree | a4b0aa90ca1e6344249e7b68e631645db2712801 /sys/dev/usb/usb.c | |
| parent | fe919984faaad7f85efad23fae9c435e3ffedfe1 (diff) | |
Don't leak information to userland in case the actual transfer length is
smaller than the requested one. From ws@NetBSD via miod@.
This problem can only occur when the USBD_SHORT_XFER_OK flag is set,
otherwise completed transfers with a length smaller than the one
submitted are treated as errors.
ok miod@
Diffstat (limited to 'sys/dev/usb/usb.c')
| -rw-r--r-- | sys/dev/usb/usb.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/sys/dev/usb/usb.c b/sys/dev/usb/usb.c index 2ed661666d7..2054f207820 100644 --- a/sys/dev/usb/usb.c +++ b/sys/dev/usb/usb.c @@ -1,4 +1,4 @@ -/* $OpenBSD: usb.c,v 1.90 2013/04/26 14:05:24 mpi Exp $ */ +/* $OpenBSD: usb.c,v 1.91 2013/05/17 09:09:11 mpi Exp $ */ /* $NetBSD: usb.c,v 1.77 2003/01/01 00:10:26 thorpej Exp $ */ /* @@ -622,6 +622,9 @@ usbioctl(dev_t devt, u_long cmd, caddr_t data, int flag, struct proc *p) error = EIO; goto ret; } + /* Only if USBD_SHORT_XFER_OK is set. */ + if (len > ur->ucr_actlen) + len = ur->ucr_actlen; if (len != 0) { if (uio.uio_rw == UIO_READ) { error = uiomove(ptr, len, &uio); |