diff options
| author | Marcus Glocker <mglocker@cvs.openbsd.org> | 2008-07-22 10:57:16 +0000 |
|---|---|---|
| committer | Marcus Glocker <mglocker@cvs.openbsd.org> | 2008-07-22 10:57:16 +0000 |
| commit | 274c04a0d7764358c45e599701f1ae961231dbf9 (patch) | |
| tree | 07296d9a00f6c06cc3b773e8e765467d471e3d25 /sys/dev/usb/uvideo.c | |
| parent | b502e7d92bffdd6f0ad0163ef001adcb0b16b3ac (diff) | |
Fix uvm_fault crash in uvideo_vs_negotation() which was reported by some
users.
Thanks to mpf@ for his help to debug this bug down.
Diffstat (limited to 'sys/dev/usb/uvideo.c')
| -rw-r--r-- | sys/dev/usb/uvideo.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sys/dev/usb/uvideo.c b/sys/dev/usb/uvideo.c index 2a6e93efc0c..fa649100f1b 100644 --- a/sys/dev/usb/uvideo.c +++ b/sys/dev/usb/uvideo.c @@ -1,4 +1,4 @@ -/* $OpenBSD: uvideo.c,v 1.56 2008/07/19 11:30:55 mglocker Exp $ */ +/* $OpenBSD: uvideo.c,v 1.57 2008/07/22 10:57:15 mglocker Exp $ */ /* * Copyright (c) 2008 Robert Nagy <robert@openbsd.org> @@ -700,7 +700,7 @@ uvideo_vs_parse_desc_frame(struct uvideo_softc *sc) break; case UDESCSUB_VS_FRAME_UNCOMPRESSED: /* XXX do correct length calculation */ - if (desc->bLength == 38) { + if (desc->bLength > 11) { if (uvideo_vs_parse_desc_frame_uncompressed(sc, desc, &fmtidx)) return (1); |