Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0b3f6569 authored by Peter Wu's avatar Peter Wu Committed by Jiri Kosina
Browse files

HID: logitech-hidpp: check WTP report length 



Malicious USB devices can send bogus reports smaller than the expected
buffer size. Ensure that the length for WTP reports is valid to avoid
reading out of bounds.

Signed-off-by: default avatarPeter Wu <peter@lekensteyn.nl>
Reviewed-by: default avatarBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
parent f254ae93

drivers/hid/hid-logitech-hidpp.c

+6 −0
Original line number Diff line number Diff line
@@ -794,6 +794,11 @@ static int wtp_raw_event(struct hid_device *hdev, u8 *data, int size) 


	switch (data[0]) {

	case 0x02:

		if (size < 2) {

			hid_err(hdev, "Received HID report of bad size (%d)",

				size);

			return 1;

		}

		if (hidpp->quirks & HIDPP_QUIRK_WTP_PHYSICAL_BUTTONS) {

			input_event(wd->input, EV_KEY, BTN_LEFT,

					!!(data[1] & 0x01));
@@ -806,6 +811,7 @@ static int wtp_raw_event(struct hid_device *hdev, u8 *data, int size) 
			return wtp_mouse_raw_xy_event(hidpp, &data[7]);

		}

	case REPORT_ID_HIDPP_LONG:

		/* size is already checked in hidpp_raw_event. */

		if ((report->fap.feature_index != wd->mt_feature_index) ||

		    (report->fap.funcindex_clientid != EVENT_TOUCHPAD_RAW_XY))

			return 1;