⬢ DragonFlyBSD Kernel Audit
DF-5543 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
--- a/sys/bus/u4b/input/uep.c	2026-10-07 08:10:29.322672341 +0000
+++ b/sys/bus/u4b/input/uep.c	2026-10-07 08:10:29.342672085 +0000
@@ -219,8 +219,11 @@
 			if (sc->buf_len == 1)
 				sc->buf[1] = buf[0];
 
-			if ((pkt_len = get_pkt_len(sc->buf)) == 0)
+			if ((pkt_len = get_pkt_len(sc->buf)) == 0) {
+				/* drop stale fragment, resync on next transfer */
+				sc->buf_len = 0;
 				goto tr_setup;
+			}
 
 			res = pkt_len - sc->buf_len;
 			memcpy(sc->buf + sc->buf_len, buf, res);
@@ -233,7 +236,7 @@
 			p = buf;
 
 		if (len == 1) {
-			sc->buf[0] = buf[0];
+			sc->buf[0] = p[0];
 			sc->buf_len = 1;
 
 			goto tr_setup;
@@ -417,6 +420,7 @@
 		struct uep_softc *sc = usb_fifo_softc(fifo);
 
 		sc->state &= ~(UEP_ENABLED);
+		sc->buf_len = 0;
 		usb_fifo_free_buffer(fifo);
 	}
 }