Re: upl(4) buffer length validation

[Loganaden Velvindron]

Hi,

Jasper pointed out that the minimum length should be 1.

Plese test !

Index: src/sys/dev/usb/if_upl.c
===================================================================
RCS file: /cvs/src/sys/dev/usb/if_upl.c,v
retrieving revision 1.47
diff -u -p -r1.47 if_upl.c
--- src/sys/dev/usb/if_upl.c    25 Jan 2011 20:03:35 -0000      1.47
+++ src/sys/dev/usb/if_upl.c    21 Mar 2011 18:51:02 -0000
@@ -494,6 +494,11 @@ upl_rxeof(usbd_xfer_handle xfer, usbd_pr
        DPRINTFN(9,("%s: %s: enter status=%d length=%d\n",
                    sc->sc_dev.dv_xname, __func__, status, total_len));
 
+       if (total_len <= 1 || total_len > UPL_BUFSZ) {
+               ifp->if_ierrors++;
+               goto done;
+       }
+
        m = c->upl_mbuf;
        memcpy(mtod(c->upl_mbuf, char *), c->upl_buf, total_len);