[src/trunk]: src/sys/dev/usb Also print and bail out if the hardware returned...

[bouyer <bouyer%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/0b57ee650bd5
branches:  trunk
changeset: 778092:0b57ee650bd5
user:      bouyer <bouyer%NetBSD.org@localhost>
date:      Thu Mar 15 18:40:32 2012 +0000

description:
Also print and bail out if the hardware returned a too large bSamFreqType,
instead of reading past descriptor array. Found by gcc -O3

diffstat:

 sys/dev/usb/uaudio.c |  10 ++++++++--
 1 files changed, 8 insertions(+), 2 deletions(-)

diffs (31 lines):

diff -r b4386e850b13 -r 0b57ee650bd5 sys/dev/usb/uaudio.c
--- a/sys/dev/usb/uaudio.c      Thu Mar 15 18:39:21 2012 +0000
+++ b/sys/dev/usb/uaudio.c      Thu Mar 15 18:40:32 2012 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: uaudio.c,v 1.129 2012/02/24 06:48:24 mrg Exp $ */
+/*     $NetBSD: uaudio.c,v 1.130 2012/03/15 18:40:32 bouyer Exp $      */
 
 /*
  * Copyright (c) 1999 The NetBSD Foundation, Inc.
@@ -37,7 +37,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: uaudio.c,v 1.129 2012/02/24 06:48:24 mrg Exp $");
+__KERNEL_RCSID(0, "$NetBSD: uaudio.c,v 1.130 2012/03/15 18:40:32 bouyer Exp $");
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -1849,6 +1849,12 @@
                                               __func__, t1desc->bSamFreqType);
                                        break;
                                }
+                               if (j >= 2) {
+                                       aprint_error("%s: too much tSamFreq: "
+                                              "%d\n",
+                                              __func__, t1desc->bSamFreqType);
+                                       break;
+                               }
                                auf->frequency[j] = UA_GETSAMP(t1desc, j);
                        }
                }