summaryrefslogtreecommitdiff
path: root/sys/dev
diff options
context:
space:
mode:
authoraugustss <augustss@NetBSD.org>2001-12-29 18:56:52 +0000
committeraugustss <augustss@NetBSD.org>2001-12-29 18:56:52 +0000
commitc19b7e5c1bd3633f78a7dade961f6c17243be460 (patch)
treec28313eb83e5c6a22ee05013f41f1b12f8fc7cf1 /sys/dev
parent5db54303c876c2d67dbe6fe1db3d20a3199c55b2 (diff)
Be more paranoid about input sizes.
Diffstat (limited to 'sys/dev')
-rw-r--r--sys/dev/usb/uhidev.c15
-rw-r--r--sys/dev/usb/uhidev.h4
2 files changed, 16 insertions, 3 deletions
diff --git a/sys/dev/usb/uhidev.c b/sys/dev/usb/uhidev.c
index 44049554a7e..b745c270015 100644
--- a/sys/dev/usb/uhidev.c
+++ b/sys/dev/usb/uhidev.c
@@ -1,4 +1,4 @@
-/* $NetBSD: uhidev.c,v 1.1 2001/12/28 17:32:36 augustss Exp $ */
+/* $NetBSD: uhidev.c,v 1.2 2001/12/29 18:56:52 augustss Exp $ */
/*
* Copyright (c) 2001 The NetBSD Foundation, Inc.
@@ -107,6 +107,7 @@ USB_ATTACH(uhidev)
struct uhidev_attach_arg uha;
struct uhidev *dev;
int size, nrepid, repid, repsz;
+ int repsizes[256];
void *desc;
usbd_status err;
char devinfo[1024];
@@ -202,6 +203,7 @@ USB_ATTACH(uhidev)
for (repid = 0; repid < nrepid; repid++) {
repsz = hid_report_size(desc, size, hid_input, repid);
DPRINTF(("uhidev_match: repid=%d, repsz=%d\n", repid, repsz));
+ repsizes[repid] = repsz;
if (repsz > 0) {
if (repsz > sc->sc_isize)
sc->sc_isize = repsz;
@@ -222,6 +224,7 @@ USB_ATTACH(uhidev)
dev = (struct uhidev *)config_found_sm(self, &uha,
uhidevprint, uhidevsubmatch);
sc->sc_subdevs[repid] = dev;
+ dev->sc_in_rep_size = repsizes[repid];
#ifdef DIAGNOSTIC
if (dev != NULL) {
DPRINTF(("uhidev_match: repid=%d dev=%p\n",
@@ -360,7 +363,10 @@ uhidev_intr(usbd_xfer_handle xfer, usbd_private_handle addr, usbd_status status)
return;
if (status != USBD_NORMAL_COMPLETION) {
- DPRINTF(("uhidev_intr: status=%d\n", status));
+#ifdef DIAGNOSTIC
+ printf("%s: interrupr status=%d\n", USBDEVNAME(sc->sc_dev),
+ status);
+#endif
usbd_clear_endpoint_stall_async(sc->sc_intrpipe);
return;
}
@@ -379,6 +385,11 @@ uhidev_intr(usbd_xfer_handle xfer, usbd_private_handle addr, usbd_status status)
rep, scd, scd ? scd->sc_state : 0));
if (scd == NULL || !(scd->sc_state & UHIDEV_OPEN))
return;
+#ifdef DIAGNOSTIC
+ if (scd->sc_in_rep_size != cc)
+ printf("%s: bad input length %d != %d\n",USBDEVNAME(sc->sc_dev),
+ scd->sc_in_rep_size, cc);
+#endif
scd->sc_intr(scd, p, cc);
}
diff --git a/sys/dev/usb/uhidev.h b/sys/dev/usb/uhidev.h
index d55c2655614..7ab68257a02 100644
--- a/sys/dev/usb/uhidev.h
+++ b/sys/dev/usb/uhidev.h
@@ -1,4 +1,4 @@
-/* $NetBSD: uhidev.h,v 1.1 2001/12/28 17:32:36 augustss Exp $ */
+/* $NetBSD: uhidev.h,v 1.2 2001/12/29 18:56:52 augustss Exp $ */
/*
* Copyright (c) 2001 The NetBSD Foundation, Inc.
@@ -66,6 +66,7 @@ struct uhidev {
struct uhidev_softc *sc_parent;
uByte sc_report_id;
u_int8_t sc_state;
+ int sc_in_rep_size;
#define UHIDEV_OPEN 0x01 /* device is open */
void (*sc_intr)(struct uhidev *, void *, u_int);
};
@@ -74,6 +75,7 @@ struct uhidev_attach_arg {
struct usb_attach_arg *uaa;
struct uhidev_softc *parent;
int reportid;
+ int reportsize;
int matchlvl;
};