diff options
| author | Pierre Pronchery <khorben@FreeBSD.org> | 2025-05-27 00:10:49 +0000 |
|---|---|---|
| committer | Pierre Pronchery <khorben@FreeBSD.org> | 2025-05-29 13:07:57 +0000 |
| commit | 82c41c9ffc42b8e95eabae7cdc4e0bfbbcad51fb (patch) | |
| tree | 28fac0412ddd12bcb35006303eea3e2c791ad210 /sys/dev/usb | |
| parent | 152bb8e3020451963a3f2a8adf05f00a5222a4e5 (diff) | |
Diffstat (limited to 'sys/dev/usb')
| -rw-r--r-- | sys/dev/usb/net/if_umb.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/sys/dev/usb/net/if_umb.c b/sys/dev/usb/net/if_umb.c index a7d3bb764a2b..5703bc03dd39 100644 --- a/sys/dev/usb/net/if_umb.c +++ b/sys/dev/usb/net/if_umb.c @@ -2147,10 +2147,12 @@ umb_decap(struct umb_softc *sc, struct usb_xfer *xfer, int frame) goto fail; } + if (len < ptroff) + goto toosmall; ptr16 = (struct ncm_pointer16 *)(buf + ptroff); psig = UGETDW(ptr16->dwSignature); ptrlen = UGETW(ptr16->wLength); - if (len < ptrlen + ptroff) + if ((uint64_t)len < (uint64_t)ptrlen + (uint64_t)ptroff) goto toosmall; if (!MBIM_NCM_NTH16_ISISG(psig) && !MBIM_NCM_NTH32_ISISG(psig)) { DPRINTF("%s: unsupported NCM pointer signature (0x%08x)\n", @@ -2197,7 +2199,7 @@ umb_decap(struct umb_softc *sc, struct usb_xfer *xfer, int frame) /* Terminating zero entry */ if (dlen == 0 || doff == 0) break; - if (len < dlen + doff) { + if ((uint64_t)len < (uint64_t)dlen + (uint64_t)doff) { /* Skip giant datagram but continue processing */ DPRINTF("%s: datagram too large (%d @ off %d)\n", DEVNAM(sc), dlen, doff); |