diff options
| author | Stefan Sperling <stsp@cvs.openbsd.org> | 2017-11-07 21:20:06 +0000 |
|---|---|---|
| committer | Stefan Sperling <stsp@cvs.openbsd.org> | 2017-11-07 21:20:06 +0000 |
| commit | fda0f93db2eb45780e55b241dd9c93b086955434 (patch) | |
| tree | 4c8700e0f32ce20008d0163da1352f7bfc9f9b18 /sys/dev/usb | |
| parent | b06899d2c1e6517bcf63f190cd9035b23a5ad866 (diff) | |
Prevent a potential stack buffer overrun when a urtwn(4) device
reports more than 3 bulk-out endpoints.
Problem found by Pierre Pronchery (khorben) during code inspection.
ok mpi@ kevlo@
Diffstat (limited to 'sys/dev/usb')
| -rw-r--r-- | sys/dev/usb/if_urtwn.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/sys/dev/usb/if_urtwn.c b/sys/dev/usb/if_urtwn.c index e6e9cbd670e..e841da1c284 100644 --- a/sys/dev/usb/if_urtwn.c +++ b/sys/dev/usb/if_urtwn.c @@ -1,4 +1,4 @@ -/* $OpenBSD: if_urtwn.c,v 1.75 2017/08/23 09:25:17 kevlo Exp $ */ +/* $OpenBSD: if_urtwn.c,v 1.76 2017/11/07 21:20:05 stsp Exp $ */ /*- * Copyright (c) 2010 Damien Bergamini <damien.bergamini@free.fr> @@ -535,7 +535,8 @@ urtwn_open_pipes(struct urtwn_softc *sc) rx_no = ed->bEndpointAddress; nrx++; } else { - epaddr[sc->ntx] = ed->bEndpointAddress; + if (sc->ntx < R92C_MAX_EPOUT) + epaddr[sc->ntx] = ed->bEndpointAddress; sc->ntx++; } } |