Aren/NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix buffer-overrun/off-by-one in hid_set_data(3).

Browse Source 
(The tests only detected this as a problem on ARMv7, not i386.)
This commit is contained in:
jakllsch 2016-01-07 19:49:45 +00:00
parent 780c330dd4
commit d804fd3f29
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
lib/libusbhid/data.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: data.c,v 1.7 2016/01/01 22:59:12 jakllsch Exp $ */
/* $NetBSD: data.c,v 1.8 2016/01/07 19:49:45 jakllsch Exp $ */
/*
* Copyright (c) 1999 Lennart Augustsson <augustss@NetBSD.org>
@ -27,7 +27,7 @@
*/
#include <sys/cdefs.h>
__RCSID("$NetBSD: data.c,v 1.7 2016/01/01 22:59:12 jakllsch Exp $");
__RCSID("$NetBSD: data.c,v 1.8 2016/01/07 19:49:45 jakllsch Exp $");
#include <assert.h>
#include <stdlib.h>
@ -95,7 +95,7 @@ hid_set_data(void *p, const hid_item_t *h, int data)
offs = hpos / 8;
end = (hpos + hsize) / 8 - offs;
for (i = 0; i <= end; i++)
for (i = 0; i < end; i++)
buf[offs + i] = (buf[offs + i] & ((uint32_t)mask >> (i*8))) |
(((uint32_t)data >> (i*8)) & 0xff);
}