• Olaf Hering's avatar
    [PATCH] USB: out of bounds access in hiddev_cleanup · 3a386413
    Olaf Hering authored
    hiddev_table[] is an array of pointers.  the minor number is used as an
    offset.  hiddev minors start either with zero, or with 96.  If they start
    with 96, the offset must be reduced by HIDDEV_MINOR_BASE because only 16
    minors are available.  unplugging a hiddevice will zero data outside the
    hiddev_table array.
    
    this was spotted by Takashi Iwai.
    3a386413
hiddev.c 20.9 KB