evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge "hid: usbhid: Changes to prevent buffer overflow"

Browse source
This commit is contained in:
Linux Build Service Account 2018-07-09 12:30:23 -07:00 • committed by Gerrit - the friendly Code Review server
commit 792f7097d5
1 changed files with 6 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
drivers/hid/usbhid/hiddev.c
View file

@ -510,14 +510,14 @@ static noinline int hiddev_ioctl_usage(struct hiddev *hiddev, unsigned int cmd,
goto inval; goto inval;
field = report->field[uref->field_index]; field = report->field[uref->field_index];
if (cmd == HIDIOCGCOLLECTIONINDEX) {
if (uref->usage_index >= field->maxusage)
goto inval;
} else if (uref->usage_index >= field->report_count)
goto inval;
} }
if (cmd == HIDIOCGCOLLECTIONINDEX) {
if (uref->usage_index >= field->maxusage)
goto inval;
} else if (uref->usage_index >= field->report_count)
goto inval;
if ((cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) && if ((cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) &&
(uref_multi->num_values > HID_MAX_MULTI_USAGES || (uref_multi->num_values > HID_MAX_MULTI_USAGES ||
uref->usage_index + uref_multi->num_values > field->report_count)) uref->usage_index + uref_multi->num_values > field->report_count))