uath: fix varible types, add checks for descriptor / command header structure fields.

[avos]

Summary

• Use 'uint32_t' to save be32toh(9) result.
• Drop too short payload (to prevent 'chunklen' underflow).
• Recheck Rx descriptor fields to prevent buffer over-read.

Test Plan

Untested.

[• hselasky]

sys/dev/usb/wlan/if_uath.c

2226

If hdr->len comes from HW, please verify that value is valid!

2231–2232

Missing upper range check?

2526–2527

chunklen should also be checked against actlen ???

2599–2612

Are the offsets and payloads within the USB buffer and below actlen ?

2640–2666

Missing upper and lower checks for desc->framelen !

[avos]

Address some possible buffer over-reads.

[avos]

sys/dev/usb/wlan/if_uath.c

2226

Done in uath_intr_rx_callback()

[avos]

• Add more 'framelen' variable checks.
• Check hdr->len before using it to calculate dlen.

[• hselasky]

I'll have a closer look at this tomorrow. Thank you!

[• hselasky]

sys/dev/usb/wlan/if_uath.c

2243–2244

Can you invert this code? It makes it more clear:

!(a && b) == ((!a) || (!b))

if (hdr->len < sizeof(*hdr) || hdr->len >= UATH_MAX_CMDSZ)

2362

if (hdr->len > (uint32_t)actlen)

2654

Add this check first? Or is it redundant?
actlen < sizeof(struct uath_chunk) ||

cast: actlen - sizeof(struct uath_chunk) to uint32_t:

framelen > (uint32_t)(actlen - sizeof(struct uath_chunk))

[avos]

sys/dev/usb/wlan/if_uath.c

2654

Already checked at the top of the function ('if (actlen < (int)UATH_MIN_RXBUFSZ)')

[• hselasky]

Looks good.