Commit 1ebb7114 authored Jan 06, 2017 by Greg Kroah-Hartman Committed by Jiri Kosina Jan 06, 2017

HID: hid-cypress: validate length of report



Make sure we have enough of a report structure to validate before
looking at it.

Reported-by: Benoit Camredon <benoit.camredon@airbus.com>
Tested-by: Benoit Camredon <benoit.camredon@airbus.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

parent 08f95726

drivers/hid/hid-cypress.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -39,6 +39,9 @@ static __u8 cp_report_fixup(struct hid_device hdev, __u8 *rdesc,
		if (!(quirks & CP_RDESC_SWAPPED_MIN_MAX))
		return rdesc;

		if (*rsize < 4)
		return rdesc;

		for (i = 0; i < *rsize - 4; i++)
		if (rdesc[i] == 0x29 && rdesc[i + 2] == 0x19) {
		rdesc[i] = 0x19;