mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-04 16:15:11 +00:00
HID: hiddev: validate num_values for HIDIOCGUSAGES, HIDIOCSUSAGES commands
This patch validates the num_values parameter from userland during the HIDIOCGUSAGES and HIDIOCSUSAGES commands. Previously, if the report id was set to HID_REPORT_ID_UNKNOWN, we would fail to validate the num_values parameter leading to a heap overflow. Cc: stable@vger.kernel.org Signed-off-by: Scott Bauer <sbauer@plzdonthack.me> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
This commit is contained in:
parent
a80e803a2a
commit
93a2001bdf
1 changed files with 5 additions and 5 deletions
|
@ -516,12 +516,12 @@ static noinline int hiddev_ioctl_usage(struct hiddev *hiddev, unsigned int cmd,
|
||||||
goto inval;
|
goto inval;
|
||||||
} else if (uref->usage_index >= field->report_count)
|
} else if (uref->usage_index >= field->report_count)
|
||||||
goto inval;
|
goto inval;
|
||||||
|
}
|
||||||
|
|
||||||
else if ((cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) &&
|
if ((cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) &&
|
||||||
(uref_multi->num_values > HID_MAX_MULTI_USAGES ||
|
(uref_multi->num_values > HID_MAX_MULTI_USAGES ||
|
||||||
uref->usage_index + uref_multi->num_values > field->report_count))
|
uref->usage_index + uref_multi->num_values > field->report_count))
|
||||||
goto inval;
|
goto inval;
|
||||||
}
|
|
||||||
|
|
||||||
switch (cmd) {
|
switch (cmd) {
|
||||||
case HIDIOCGUSAGE:
|
case HIDIOCGUSAGE:
|
||||||
|
|
Loading…
Reference in a new issue