lkml.org 
[lkml]   [2014]   [Oct]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.10 027/143] HID: magicmouse: sanity check report size in raw_event() callback
    Date
    3.10-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Jiri Kosina <jkosina@suse.cz>

    commit c54def7bd64d7c0b6993336abcffb8444795bf38 upstream.

    The report passed to us from transport driver could potentially be
    arbitrarily large, therefore we better sanity-check it so that
    magicmouse_emit_touch() gets only valid values of raw_id.

    Reported-by: Steven Vittitoe <scvitti@google.com>
    Signed-off-by: Jiri Kosina <jkosina@suse.cz>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/hid/hid-magicmouse.c | 10 ++++++++++
    1 file changed, 10 insertions(+)

    --- a/drivers/hid/hid-magicmouse.c
    +++ b/drivers/hid/hid-magicmouse.c
    @@ -290,6 +290,11 @@ static int magicmouse_raw_event(struct h
    if (size < 4 || ((size - 4) % 9) != 0)
    return 0;
    npoints = (size - 4) / 9;
    + if (npoints > 15) {
    + hid_warn(hdev, "invalid size value (%d) for TRACKPAD_REPORT_ID\n",
    + size);
    + return 0;
    + }
    msc->ntouches = 0;
    for (ii = 0; ii < npoints; ii++)
    magicmouse_emit_touch(msc, ii, data + ii * 9 + 4);
    @@ -307,6 +312,11 @@ static int magicmouse_raw_event(struct h
    if (size < 6 || ((size - 6) % 8) != 0)
    return 0;
    npoints = (size - 6) / 8;
    + if (npoints > 15) {
    + hid_warn(hdev, "invalid size value (%d) for MOUSE_REPORT_ID\n",
    + size);
    + return 0;
    + }
    msc->ntouches = 0;
    for (ii = 0; ii < npoints; ii++)
    magicmouse_emit_touch(msc, ii, data + ii * 8 + 6);



    \
     
     \ /
      Last update: 2014-10-04 01:41    [W:4.363 / U:0.340 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site