summaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
authorZbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>2015-03-13 21:22:02 -0500
committerZbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>2015-03-13 23:42:17 -0400
commit24bfda116ce2a627aebe3eba3ad71d34498f5545 (patch)
tree6d0d89688453b2693117245dc348386e66fafe87 /src
parent9116b40692cf973eca74731860bfaa58daeb9543 (diff)
udev: properly calculate size of remaining data
The data comes from the kernel, so chances of it being garbled are low, but for correctness' sake, add the check. CID #996458.
Diffstat (limited to 'src')
-rw-r--r--src/udev/udev-builtin-usb_id.c24
1 files changed, 13 insertions, 11 deletions
diff --git a/src/udev/udev-builtin-usb_id.c b/src/udev/udev-builtin-usb_id.c
index 6516d93a3c..e6c27a901f 100644
--- a/src/udev/udev-builtin-usb_id.c
+++ b/src/udev/udev-builtin-usb_id.c
@@ -150,18 +150,18 @@ static int dev_if_packed_info(struct udev_device *dev, char *ifs_str, size_t len
_cleanup_close_ int fd = -1;
ssize_t size;
unsigned char buf[18 + 65535];
- int pos = 0;
+ size_t pos = 0;
unsigned strpos = 0;
struct usb_interface_descriptor {
- uint8_t bLength;
- uint8_t bDescriptorType;
- uint8_t bInterfaceNumber;
- uint8_t bAlternateSetting;
- uint8_t bNumEndpoints;
- uint8_t bInterfaceClass;
- uint8_t bInterfaceSubClass;
- uint8_t bInterfaceProtocol;
- uint8_t iInterface;
+ uint8_t bLength;
+ uint8_t bDescriptorType;
+ uint8_t bInterfaceNumber;
+ uint8_t bAlternateSetting;
+ uint8_t bNumEndpoints;
+ uint8_t bInterfaceClass;
+ uint8_t bInterfaceSubClass;
+ uint8_t bInterfaceProtocol;
+ uint8_t iInterface;
} _packed_;
if (asprintf(&filename, "%s/descriptors", udev_device_get_syspath(dev)) < 0)
@@ -178,7 +178,9 @@ static int dev_if_packed_info(struct udev_device *dev, char *ifs_str, size_t len
return -EIO;
ifs_str[0] = '\0';
- while (pos < size && strpos+7 < len-2) {
+ while (pos + sizeof(struct usb_interface_descriptor) < (size_t) size &&
+ strpos + 7 < len - 2) {
+
struct usb_interface_descriptor *desc;
char if_str[8];