Commit 3a034a7a authored Dec 11, 2014 by Peter Wu Committed by Jiri Kosina Dec 11, 2014

HID: logitech-hidpp: add boundary check for name retrieval



The HID response has a limited size. Do not trust the value returned by
hardware, check that it really fits in the message.

Signed-off-by: Peter Wu <peter@lekensteyn.nl>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

parent 1430ee73

drivers/hid/hid-logitech-hidpp.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -313,6 +313,9 @@ static char hidpp_get_unifying_name(struct hidpp_device hidpp_dev)

		len = response.rap.params[1];

		if (2 + len > sizeof(response.rap.params))
		return NULL;

		name = kzalloc(len + 1, GFP_KERNEL);
		if (!name)
		return NULL;