Commit 1ebb7114 authored by Greg Kroah-Hartman's avatar Greg Kroah-Hartman Committed by Jiri Kosina

HID: hid-cypress: validate length of report

Make sure we have enough of a report structure to validate before
looking at it.
Reported-by: default avatarBenoit Camredon <benoit.camredon@airbus.com>
Tested-by: default avatarBenoit Camredon <benoit.camredon@airbus.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
parent 08f95726
...@@ -39,6 +39,9 @@ static __u8 *cp_report_fixup(struct hid_device *hdev, __u8 *rdesc, ...@@ -39,6 +39,9 @@ static __u8 *cp_report_fixup(struct hid_device *hdev, __u8 *rdesc,
if (!(quirks & CP_RDESC_SWAPPED_MIN_MAX)) if (!(quirks & CP_RDESC_SWAPPED_MIN_MAX))
return rdesc; return rdesc;
if (*rsize < 4)
return rdesc;
for (i = 0; i < *rsize - 4; i++) for (i = 0; i < *rsize - 4; i++)
if (rdesc[i] == 0x29 && rdesc[i + 2] == 0x19) { if (rdesc[i] == 0x29 && rdesc[i + 2] == 0x19) {
rdesc[i] = 0x19; rdesc[i] = 0x19;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment