Messages in this thread | | | Date | Wed, 11 Oct 2017 15:06:00 +0200 (CEST) | From | Jiri Kosina <> | Subject | Re: [PATCH v2] HID: usbhid: fix out-of-bounds bug |
| |
On Thu, 28 Sep 2017, Jaejoong Kim wrote:
> The hid descriptor identifies the length and type of subordinate > descriptors for a device. If the received hid descriptor is smaller than > the size of the struct hid_descriptor, it is possible to cause > out-of-bounds. > > In addition, if bNumDescriptors of the hid descriptor have an incorrect > value, this can also cause out-of-bounds while approaching hdesc->desc[n]. > > So check the size of hid descriptor and bNumDescriptors.
Applied to for-4.14/upstream-fixes. Thanks,
-- Jiri Kosina SUSE Labs
| |