Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b1f03427 authored by Linux Build Service Account's avatar Linux Build Service Account Committed by Gerrit - the friendly Code Review server
Browse files

Merge "HID: usbhid: fix out-of-bounds bug"

parents 5e8e9ddc d0479459

drivers/hid/usbhid/hid-core.c

+11 −1
Original line number Diff line number Diff line
@@ -971,6 +971,8 @@ static int usbhid_parse(struct hid_device *hid) 
	unsigned int rsize = 0;

	char *rdesc;

	int ret, n;

	int num_descriptors;

	size_t offset = offsetof(struct hid_descriptor, desc);



	quirks = usbhid_lookup_quirk(le16_to_cpu(dev->descriptor.idVendor),

			le16_to_cpu(dev->descriptor.idProduct));
@@ -993,10 +995,18 @@ static int usbhid_parse(struct hid_device *hid) 
		return -ENODEV;

	}



	if (hdesc->bLength < sizeof(struct hid_descriptor)) {

		dbg_hid("hid descriptor is too short\n");

		return -EINVAL;

	}



	hid->version = le16_to_cpu(hdesc->bcdHID);

	hid->country = hdesc->bCountryCode;



	for (n = 0; n < hdesc->bNumDescriptors; n++)

	num_descriptors = min_t(int, hdesc->bNumDescriptors,

	       (hdesc->bLength - offset) / sizeof(struct hid_class_descriptor));



	for (n = 0; n < num_descriptors; n++)

		if (hdesc->desc[n].bDescriptorType == HID_DT_REPORT)

			rsize = le16_to_cpu(hdesc->desc[n].wDescriptorLength);