Commit 249b61a6 authored by Jiri Kosina's avatar Jiri Kosina Committed by Greg Kroah-Hartman

HID: magicmouse: sanity check report size in raw_event() callback

commit c54def7b upstream.

The report passed to us from transport driver could potentially be
arbitrarily large, therefore we better sanity-check it so that
magicmouse_emit_touch() gets only valid values of raw_id.
Reported-by: default avatarSteven Vittitoe <scvitti@google.com>
Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 0db6de5f
...@@ -290,6 +290,11 @@ static int magicmouse_raw_event(struct hid_device *hdev, ...@@ -290,6 +290,11 @@ static int magicmouse_raw_event(struct hid_device *hdev,
if (size < 4 || ((size - 4) % 9) != 0) if (size < 4 || ((size - 4) % 9) != 0)
return 0; return 0;
npoints = (size - 4) / 9; npoints = (size - 4) / 9;
if (npoints > 15) {
hid_warn(hdev, "invalid size value (%d) for TRACKPAD_REPORT_ID\n",
size);
return 0;
}
msc->ntouches = 0; msc->ntouches = 0;
for (ii = 0; ii < npoints; ii++) for (ii = 0; ii < npoints; ii++)
magicmouse_emit_touch(msc, ii, data + ii * 9 + 4); magicmouse_emit_touch(msc, ii, data + ii * 9 + 4);
...@@ -307,6 +312,11 @@ static int magicmouse_raw_event(struct hid_device *hdev, ...@@ -307,6 +312,11 @@ static int magicmouse_raw_event(struct hid_device *hdev,
if (size < 6 || ((size - 6) % 8) != 0) if (size < 6 || ((size - 6) % 8) != 0)
return 0; return 0;
npoints = (size - 6) / 8; npoints = (size - 6) / 8;
if (npoints > 15) {
hid_warn(hdev, "invalid size value (%d) for MOUSE_REPORT_ID\n",
size);
return 0;
}
msc->ntouches = 0; msc->ntouches = 0;
for (ii = 0; ii < npoints; ii++) for (ii = 0; ii < npoints; ii++)
magicmouse_emit_touch(msc, ii, data + ii * 8 + 6); magicmouse_emit_touch(msc, ii, data + ii * 8 + 6);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment