Commit 844817e4 authored Aug 27, 2014 by Jiri Kosina

HID: picolcd: sanity check report size in raw_event() callback



The report passed to us from transport driver could potentially be
arbitrarily large, therefore we better sanity-check it so that raw_data
that we hold in picolcd_pending structure are always kept within proper
bounds.

Cc: stable@vger.kernel.org
Reported-by: Steven Vittitoe <scvitti@google.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

parent c54def7b

drivers/hid/hid-picolcd_core.c

+6 −0

Original line number	Diff line number	Diff line
		@@ -350,6 +350,12 @@ static int picolcd_raw_event(struct hid_device *hdev,
		if (!data)
		return 1;

		if (size > 64) {
		hid_warn(hdev, "invalid size value (%d) for picolcd raw event\n",
		size);
		return 0;
		}

		if (report->id == REPORT_KEY_STATE) {
		if (data->input_keys)
		ret = picolcd_raw_keypad(data, report, raw_data+1, size-1);