• Grant Hernandez's avatar
    Input: gtco - bounds check collection indent level · 2a017fd8
    Grant Hernandez authored
    The GTCO tablet input driver configures itself from an HID report sent
    via USB during the initial enumeration process. Some debugging messages
    are generated during the parsing. A debugging message indentation
    counter is not bounds checked, leading to the ability for a specially
    crafted HID report to cause '-' and null bytes be written past the end
    of the indentation array. As long as the kernel has CONFIG_DYNAMIC_DEBUG
    enabled, this code will not be optimized out.  This was discovered
    during code review after a previous syzkaller bug was found in this
    driver.
    Signed-off-by: default avatarGrant Hernandez <granthernandez@google.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: default avatarDmitry Torokhov <dmitry.torokhov@gmail.com>
    2a017fd8
gtco.c 26.9 KB