From 0bfec2bd5ff6313742e75afeb801ea742e204abd Mon Sep 17 00:00:00 2001 From: hselasky Date: Sun, 3 Apr 2011 20:54:32 +0000 Subject: [PATCH] MFC r213433 Tighten USB string filtering. Approved by: thompsa (mentor) git-svn-id: svn://svn.freebsd.org/base/stable/8@220305 ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f --- sys/dev/usb/usb_request.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/sys/dev/usb/usb_request.c b/sys/dev/usb/usb_request.c index dfb9b4cd4..293c4bfc8 100644 --- a/sys/dev/usb/usb_request.c +++ b/sys/dev/usb/usb_request.c @@ -1117,14 +1117,21 @@ usbd_req_get_string_any(struct usb_device *udev, struct mtx *mtx, char *buf, } /* - * Filter by default - we don't allow greater and less than - * signs because they might confuse the dmesg printouts! + * Filter by default - We only allow alphanumerical + * and a few more to avoid any problems with scripts + * and daemons. */ - if ((*s == '<') || (*s == '>') || (!isprint(*s))) { - /* silently skip bad character */ - continue; + if (isalpha(*s) || + isdigit(*s) || + *s == '-' || + *s == '+' || + *s == ' ' || + *s == '.' || + *s == ',') { + /* allowed */ + s++; } - s++; + /* silently skip bad character */ } *s = 0; /* zero terminate resulting string */ return (USB_ERR_NORMAL_COMPLETION); -- 2.45.0