CVS commit: src/sys/dev/usb

["Taylor R Campbell" <riastradh%netbsd.org@localhost>]

Module Name:    src
Committed By:   riastradh
Date:           Sat May 14 15:28:59 UTC 2022

Modified Files:
        src/sys/dev/usb: uvideoreg.h

Log Message:
uvideo(4): Fix lengths of various frame descriptors.

This driver doesn't use the frame interval members, which are either
fixed (if continuous) or flexible (if discrete) and so can't be
encoded in C types correctly.  If we did use them, it would be
necessary to use pointer arithmetic on char pointers in the enclosing
descriptor buffer.  But we don't, so this is simpler, and fixes the
sizeof checks to avoid running off the end of invalid descriptors.

Should fix failure to parse legitimate descriptors (without
regressing to choking on malicious ones):

-uvideo: found format (index 1) type 9 size 1280x720 size 1843200 stride 2560 interval 333333
- ^ picking this one
-uvideo: found format (index 2) type 9 size 640x480 size 614400 stride 1280 interval 333333
+uvideo: truncated CS subtype-0x7 descriptor, length 30 < 38uvideo: unimplemented VS CS descriptor len=30 type=0x24 subtype=0x07
+uvideo: unimplemented VS CS descriptor len=30 type=0x24 subtype=0x07


To generate a diff of this commit:
cvs rdiff -u -r1.6 -r1.7 src/sys/dev/usb/uvideoreg.h

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.