mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-29 13:53:33 +00:00
HID: hid-steam: Better handling of serial number length
The second byte of the GET_STRING_ATTRIB report is a length, so we should set the size of the buffer to be the size we're actually requesting, and only reject the reply if the length out is nonsensical. Signed-off-by: Vicki Pfau <vi@endrift.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
This commit is contained in:
parent
4f9a5a9769
commit
43565b6788
1 changed files with 6 additions and 5 deletions
|
@ -274,7 +274,7 @@ enum {
|
||||||
};
|
};
|
||||||
|
|
||||||
/* Other random constants */
|
/* Other random constants */
|
||||||
#define STEAM_SERIAL_LEN 10
|
#define STEAM_SERIAL_LEN 0x15
|
||||||
|
|
||||||
struct steam_device {
|
struct steam_device {
|
||||||
struct list_head list;
|
struct list_head list;
|
||||||
|
@ -421,10 +421,10 @@ static int steam_get_serial(struct steam_device *steam)
|
||||||
{
|
{
|
||||||
/*
|
/*
|
||||||
* Send: 0xae 0x15 0x01
|
* Send: 0xae 0x15 0x01
|
||||||
* Recv: 0xae 0x15 0x01 serialnumber (10 chars)
|
* Recv: 0xae 0x15 0x01 serialnumber
|
||||||
*/
|
*/
|
||||||
int ret = 0;
|
int ret = 0;
|
||||||
u8 cmd[] = {ID_GET_STRING_ATTRIBUTE, 0x15, ATTRIB_STR_UNIT_SERIAL};
|
u8 cmd[] = {ID_GET_STRING_ATTRIBUTE, sizeof(steam->serial_no), ATTRIB_STR_UNIT_SERIAL};
|
||||||
u8 reply[3 + STEAM_SERIAL_LEN + 1];
|
u8 reply[3 + STEAM_SERIAL_LEN + 1];
|
||||||
|
|
||||||
mutex_lock(&steam->report_mutex);
|
mutex_lock(&steam->report_mutex);
|
||||||
|
@ -434,12 +434,13 @@ static int steam_get_serial(struct steam_device *steam)
|
||||||
ret = steam_recv_report(steam, reply, sizeof(reply));
|
ret = steam_recv_report(steam, reply, sizeof(reply));
|
||||||
if (ret < 0)
|
if (ret < 0)
|
||||||
goto out;
|
goto out;
|
||||||
if (reply[0] != ID_GET_STRING_ATTRIBUTE || reply[1] != 0x15 || reply[2] != ATTRIB_STR_UNIT_SERIAL) {
|
if (reply[0] != ID_GET_STRING_ATTRIBUTE || reply[1] < 1 ||
|
||||||
|
reply[1] > sizeof(steam->serial_no) || reply[2] != ATTRIB_STR_UNIT_SERIAL) {
|
||||||
ret = -EIO;
|
ret = -EIO;
|
||||||
goto out;
|
goto out;
|
||||||
}
|
}
|
||||||
reply[3 + STEAM_SERIAL_LEN] = 0;
|
reply[3 + STEAM_SERIAL_LEN] = 0;
|
||||||
strscpy(steam->serial_no, reply + 3, sizeof(steam->serial_no));
|
strscpy(steam->serial_no, reply + 3, reply[1]);
|
||||||
out:
|
out:
|
||||||
mutex_unlock(&steam->report_mutex);
|
mutex_unlock(&steam->report_mutex);
|
||||||
return ret;
|
return ret;
|
||||||
|
|
Loading…
Reference in a new issue