i2p/haiku-beta6
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Apply limits to the transfer lengths. At least in the case where a one byte FTDI

Browse Source 
header is used that only has 6 bits of length info this would've previously
potentially overflowed depending on the input size.


git-svn-id: file:///srv/svn/repos/haiku/haiku/trunk@42088 a95241bf-73f2-0310-859d-f6bbb57e9c96
This commit is contained in:
Michael Lotz
2011-06-10 17:20:27 +00:00
parent f7868b8f1a
commit 5cc760197a
2 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/add-ons/kernel/drivers/ports/usb_serial/FTDI.cpp
+4 -1
View File
@@ -225,9 +225,12 @@ FTDIDevice::OnRead(char **buffer, size_t *numBytes)
void void
FTDIDevice::OnWrite(const char *buffer, size_t *numBytes, size_t *packetBytes) FTDIDevice::OnWrite(const char *buffer, size_t *numBytes, size_t *packetBytes)
{ {
if (*numBytes > FTDI_BUFFER_SIZE)
*numBytes = *packetBytes = FTDI_BUFFER_SIZE;
char *writeBuffer = WriteBuffer(); char *writeBuffer = WriteBuffer();
if (fHeaderLength > 0) { if (fHeaderLength > 0) {
if (*numBytes >= WriteBufferSize() - fHeaderLength) if (*numBytes > WriteBufferSize() - fHeaderLength)
*numBytes = *packetBytes = WriteBufferSize() - fHeaderLength; *numBytes = *packetBytes = WriteBufferSize() - fHeaderLength;
*writeBuffer = FTDI_OUT_TAG(*numBytes, FTDI_PIT_DEFAULT); *writeBuffer = FTDI_OUT_TAG(*numBytes, FTDI_PIT_DEFAULT);
src/add-ons/kernel/drivers/ports/usb_serial/KLSI.cpp
+4 -1
View File
@@ -149,7 +149,10 @@ KLSIDevice::OnRead(char **buffer, size_t *numBytes)
void void
KLSIDevice::OnWrite(const char *buffer, size_t *numBytes, size_t *packetBytes) KLSIDevice::OnWrite(const char *buffer, size_t *numBytes, size_t *packetBytes)
{ {
if (*numBytes >= WriteBufferSize() - 2) if (*numBytes > KLSI_BUFFER_SIZE)
*numBytes = *packetBytes = KLSI_BUFFER_SIZE;
if (*numBytes > WriteBufferSize() - 2)
*numBytes = *packetBytes = WriteBufferSize() - 2; *numBytes = *packetBytes = WriteBufferSize() - 2;
char *writeBuffer = WriteBuffer(); char *writeBuffer = WriteBuffer();