Fix uvm_fault crash in uvideo_vs_negotation() which was reported by some

users.

Thanks to mpf@ for his help to debug this bug down.

diff --git a/sys/dev/usb/uvideo.c b/sys/dev/usb/uvideo.c
index 2a6e93e..fa64910 100644 (file)
--- a/sys/dev/usb/uvideo.c
+++ b/sys/dev/usb/uvideo.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: uvideo.c,v 1.56 2008/07/19 11:30:55 mglocker Exp $ */
+/*     $OpenBSD: uvideo.c,v 1.57 2008/07/22 10:57:15 mglocker Exp $ */
 
 /*
  * Copyright (c) 2008 Robert Nagy <robert@openbsd.org>
@@ -700,7 +700,7 @@ uvideo_vs_parse_desc_frame(struct uvideo_softc *sc)
                        break;
                case UDESCSUB_VS_FRAME_UNCOMPRESSED:
                        /* XXX do correct length calculation */
-                       if (desc->bLength == 38) {
+                       if (desc->bLength > 11) {
                                if (uvideo_vs_parse_desc_frame_uncompressed(sc,
                                    desc, &fmtidx))
                                        return (1);