Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b26721cb authored by Linux Build Service Account's avatar Linux Build Service Account Committed by Gerrit - the friendly Code Review server
Browse files

Merge "HID: usbhid: fix out-of-bounds bug"

parents 9630d081 6dfc672c

drivers/hid/usbhid/hid-core.c

+11 −1
Original line number Diff line number Diff line
@@ -959,6 +959,8 @@ static int usbhid_parse(struct hid_device *hid) 
	unsigned int rsize = 0;

	char *rdesc;

	int ret, n;

	int num_descriptors;

	size_t offset = offsetof(struct hid_descriptor, desc);



	quirks = usbhid_lookup_quirk(le16_to_cpu(dev->descriptor.idVendor),

			le16_to_cpu(dev->descriptor.idProduct));
@@ -981,10 +983,18 @@ static int usbhid_parse(struct hid_device *hid) 
		return -ENODEV;

	}



	if (hdesc->bLength < sizeof(struct hid_descriptor)) {

		dbg_hid("hid descriptor is too short\n");

		return -EINVAL;

	}



	hid->version = le16_to_cpu(hdesc->bcdHID);

	hid->country = hdesc->bCountryCode;



	for (n = 0; n < hdesc->bNumDescriptors; n++)

	num_descriptors = min_t(int, hdesc->bNumDescriptors,

	       (hdesc->bLength - offset) / sizeof(struct hid_class_descriptor));



	for (n = 0; n < num_descriptors; n++)

		if (hdesc->desc[n].bDescriptorType == HID_DT_REPORT)

			rsize = le16_to_cpu(hdesc->desc[n].wDescriptorLength);

drivers/usb/core/config.c

+4 −2
Original line number Diff line number Diff line
@@ -829,10 +829,12 @@ int usb_get_bos_descriptor(struct usb_device *dev) 
	for (i = 0; i < num; i++) {

		buffer += length;

		cap = (struct usb_dev_cap_header *)buffer;

		length = cap->bLength;



		if (total_len < length)

		if (total_len < sizeof(*cap) || total_len < cap->bLength) {

			dev->bos->desc->bNumDeviceCaps = i;

			break;

		}

		length = cap->bLength;

		total_len -= length;



		if (cap->bDescriptorType != USB_DT_DEVICE_CAPABILITY) {