⬢ DragonFlyBSD Kernel Audit
DF-1046 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
diff --git a/sys/bus/u4b/uvc/uvc_ctrls.c b/sys/bus/u4b/uvc/uvc_ctrls.c
--- a/sys/bus/u4b/uvc/uvc_ctrls.c
+++ b/sys/bus/u4b/uvc/uvc_ctrls.c
@@ -919,10 +919,11 @@
 {
 	struct uvc_topo_node *topo_node, *tmp;
 	struct uvc_control *ctrl = NULL;
-	uint8_t bCtrlSize = 0;
+	unsigned int bCtrlSize = 0;
 	uint32_t nctrls = 0;
 	uint8_t *bmCtrls = NULL;
-	uint8_t i = 0;
+	unsigned int i = 0;
+	uint32_t ctrl_idx = 0;
 
 	struct uvc_xu_node_info *node_info_xu = NULL;
 	struct uvc_pu_node_info *node_info_pu = NULL;
@@ -965,13 +966,22 @@
 			if (uvc_test_bit(bmCtrls, i) == 0)
 				continue;
 
+			if (ctrl_idx >= nctrls) {
+				kprintf("%s: bitmap/count mismatch (bit %u, "
+				    "ctrl_idx %u >= nctrls %u)\n",
+				    __func__, i, ctrl_idx, nctrls);
+				break;
+			}
+
 			ctrl->topo_node = topo_node;
 			ctrl->index = i;
 
 			uvc_ctrl_initialize_control(ctrl);
 
 			ctrl++;
+			ctrl_idx++;
 		}
+		ctrl_idx = 0;
 	}
 
 	return 0;