re: kern/55919: Creative HP-BTW3 (BT-W3) USB audio device has another descriptor layout

[matthew green <mrg%eterna.com.au@localhost>]

The following reply was made to PR kern/55919; it has been noted by GNATS.

From: matthew green <mrg%eterna.com.au@localhost>
To: gnats-bugs%netbsd.org@localhost
Cc: kern-bug-people%netbsd.org@localhost, gnats-admin%netbsd.org@localhost,
    netbsd-bugs%netbsd.org@localhost, ryo%tetera.org@localhost
Subject: re: kern/55919: Creative HP-BTW3 (BT-W3) USB audio device has another descriptor layout
Date: Mon, 15 Feb 2021 18:34:52 +1100

 +       while (offs < size) {
 +               desc = (const void *)(tbuf + offs);
 
 should this be "offs <= size - sizeof(*desc)"?  so that we
 don't attempt to read beyond the buffer for this part, and
 these should probably check the larger structure size before
 deciding it's valid:
 
 +                       asid = (const void *)desc;
 +                       offs += asid->bLength;
 
 +                       asf1d = (const void *)desc;
 +                       offs += asf1d->bLength;
 
 etc..
 
 rest LGTM.  would be nice to have tested on many usb audio
 devices :)
 
 
 .mrg.