CVS commit: src/sys/dev/usb

[Manuel Bouyer]

Module Name:    src
Committed By:   bouyer
Date:           Thu Mar 15 18:40:32 UTC 2012

Modified Files:
        src/sys/dev/usb: uaudio.c

Log Message:
Also print and bail out if the hardware returned a too large bSamFreqType,
instead of reading past descriptor array. Found by gcc -O3


To generate a diff of this commit:
cvs rdiff -u -r1.129 -r1.130 src/sys/dev/usb/uaudio.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.


Modified files:

Index: src/sys/dev/usb/uaudio.c
diff -u src/sys/dev/usb/uaudio.c:1.129 src/sys/dev/usb/uaudio.c:1.130
--- src/sys/dev/usb/uaudio.c:1.129	Fri Feb 24 06:48:24 2012
+++ src/sys/dev/usb/uaudio.c	Thu Mar 15 18:40:32 2012
@@ -1,4 +1,4 @@
-/*	$NetBSD: uaudio.c,v 1.129 2012/02/24 06:48:24 mrg Exp $	*/
+/*	$NetBSD: uaudio.c,v 1.130 2012/03/15 18:40:32 bouyer Exp $	*/
 
 /*
  * Copyright (c) 1999 The NetBSD Foundation, Inc.
@@ -37,7 +37,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: uaudio.c,v 1.129 2012/02/24 06:48:24 mrg Exp $");
+__KERNEL_RCSID(0, "$NetBSD: uaudio.c,v 1.130 2012/03/15 18:40:32 bouyer Exp $");
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -1849,6 +1849,12 @@ uaudio_identify_as(struct uaudio_softc *
 					       __func__, t1desc->bSamFreqType);
 					break;
 				}
+				if (j >= 2) {
+					aprint_error("%s: too much tSamFreq: "
+					       "%d\n",
+					       __func__, t1desc->bSamFreqType);
+					break;
+				}
 				auf->frequency[j] = UA_GETSAMP(t1desc, j);
 			}
 		}