• Paulo Marques's avatar
    [PATCH] USB: fix usblp.c · 5baa19b3
    Paulo Marques authored
    The line that IMHO triggers the bug is this:
    
    "writecount += usblp->writeurb->transfer_buffer_length;"
    
    It uses "usblp->writeurb->transfer_buffer_length" before initializing it,
    assuming that it will be zero on the first run. If it is not zero, but instead
    random *negative* garbage from memory, the loop will start printing endless data
    from user-space data.
    5baa19b3
usblp.c 32.2 KB