From: ratchov <ratchov@openbsd.org>
Date: Wed, 8 Aug 2018 14:25:50 +0000 (+0000)
Subject: Fix possible division by zero caused by bogus usb descriptors. From
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=627abd9cad3abd34c1355bf48420eeca9f1bba05;p=openbsd

Fix possible division by zero caused by bogus usb descriptors. From
Michael W. Bombardieri. Thanks.
---

diff --git a/sys/dev/usb/uaudio.c b/sys/dev/usb/uaudio.c
index 129207ce0c3..c140cad526a 100644
--- a/sys/dev/usb/uaudio.c
+++ b/sys/dev/usb/uaudio.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: uaudio.c,v 1.131 2018/07/30 11:51:42 ratchov Exp $ */
+/*	$OpenBSD: uaudio.c,v 1.132 2018/08/08 14:25:50 ratchov Exp $ */
 /*	$NetBSD: uaudio.c,v 1.90 2004/10/29 17:12:53 kent Exp $	*/
 
 /*
@@ -1069,15 +1069,19 @@ uaudio_add_feature(struct uaudio_softc *sc, const struct io_terminal *iot, int i
 	const struct usb_audio_feature_unit *d = iot[id].d.fu;
 	uByte *ctls = (uByte *)d->bmaControls;
 	int ctlsize = d->bControlSize;
-	int nchan = (d->bLength - 7) / ctlsize;
 	u_int fumask, mmask, cmask;
 	struct mixerctl mix;
-	int chan, ctl, i, unit;
+	int chan, ctl, i, nchan, unit;
 	const char *mixername;
 
 #define GET(i) (ctls[(i)*ctlsize] | \
 		(ctlsize > 1 ? ctls[(i)*ctlsize+1] << 8 : 0))
 
+	if (ctlsize == 0) {
+		DPRINTF(("ignoring feature %d: bControlSize == 0\n", id));
+		return;
+	}
+	nchan = (d->bLength - 7) / ctlsize;
 	mmask = GET(0);
 	/* Figure out what we can control */
 	for (cmask = 0, chan = 1; chan < nchan; chan++) {