Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d495c1ba authored by Hans de Goede's avatar Hans de Goede Committed by Sarah Sharp
Browse files

uas: Fix bounds check in uas_find_endpoints 



The loop uses up to 3 bytes of the endpoint extra data.

Signed-off-by: default avatarHans de Goede <hdegoede@redhat.com>
Signed-off-by: default avatarSarah Sharp <sarah.a.sharp@linux.intel.com>
parent 34f11e59

drivers/usb/storage/uas.c

+1 −1
Original line number Diff line number Diff line
@@ -907,7 +907,7 @@ static int uas_find_endpoints(struct usb_host_interface *alt, 
	for (i = 0; i < n_endpoints; i++) {

		unsigned char *extra = endpoint[i].extra;

		int len = endpoint[i].extralen;

		while (len > 1) {

		while (len >= 3) {

			if (extra[1] == USB_DT_PIPE_USAGE) {

				unsigned pipe_id = extra[2];

				if (pipe_id > 0 && pipe_id < 5)