916e606784
CVE-2022-39316, CVE-2022-39317: Add missing length checks in zgfx CVE-2022-39318: Fix division by zero in urbdrc channel CVE-2022-39319: Add missing length checks in urbdrc channel CVE-2022-39320: Ensure urb_create_iocompletion uses size_t CVE-2022-39347: Fix path validation in drive channel CVE-2022-41877: Add missing length check in drive channel Resolves: #2145140
40 lines
1.4 KiB
Diff
40 lines
1.4 KiB
Diff
From b9c5e3668c4022b34734ac8ccb07dd044d4ff38c Mon Sep 17 00:00:00 2001
|
|
From: akallabeth <akallabeth@posteo.net>
|
|
Date: Thu, 13 Oct 2022 08:27:41 +0200
|
|
Subject: [PATCH] Fixed division by zero in urbdrc
|
|
|
|
(cherry picked from commit 731f8419d04b481d7160de1f34062d630ed48765)
|
|
---
|
|
channels/urbdrc/client/libusb/libusb_udevice.c | 12 +++++++++---
|
|
1 file changed, 9 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/channels/urbdrc/client/libusb/libusb_udevice.c b/channels/urbdrc/client/libusb/libusb_udevice.c
|
|
index aa69890ae..5784d9fe2 100644
|
|
--- a/channels/urbdrc/client/libusb/libusb_udevice.c
|
|
+++ b/channels/urbdrc/client/libusb/libusb_udevice.c
|
|
@@ -1214,12 +1214,18 @@ static int libusb_udev_isoch_transfer(IUDEVICE* idev, URBDRC_CHANNEL_CALLBACK* c
|
|
if (!Buffer)
|
|
Stream_Seek(user_data->data, (NumberOfPackets * 12));
|
|
|
|
- iso_packet_size = BufferSize / NumberOfPackets;
|
|
- iso_transfer = libusb_alloc_transfer(NumberOfPackets);
|
|
+ if (NumberOfPackets > 0)
|
|
+ {
|
|
+ iso_packet_size = BufferSize / NumberOfPackets;
|
|
+ iso_transfer = libusb_alloc_transfer((int)NumberOfPackets);
|
|
+ }
|
|
|
|
if (iso_transfer == NULL)
|
|
{
|
|
- WLog_Print(urbdrc->log, WLOG_ERROR, "Error: libusb_alloc_transfer.");
|
|
+ WLog_Print(urbdrc->log, WLOG_ERROR,
|
|
+ "Error: libusb_alloc_transfer [NumberOfPackets=%" PRIu32 ", BufferSize=%" PRIu32
|
|
+ " ]",
|
|
+ NumberOfPackets, BufferSize);
|
|
async_transfer_user_data_free(user_data);
|
|
return -1;
|
|
}
|
|
--
|
|
2.37.1
|
|
|