lkml.org 
[lkml]   [2017]   [Oct]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH v2] HID: usbhid: fix out-of-bounds bug
On Thu, 28 Sep 2017, Jaejoong Kim wrote:

> The hid descriptor identifies the length and type of subordinate
> descriptors for a device. If the received hid descriptor is smaller than
> the size of the struct hid_descriptor, it is possible to cause
> out-of-bounds.
>
> In addition, if bNumDescriptors of the hid descriptor have an incorrect
> value, this can also cause out-of-bounds while approaching hdesc->desc[n].
>
> So check the size of hid descriptor and bNumDescriptors.

Applied to for-4.14/upstream-fixes. Thanks,

--
Jiri Kosina
SUSE Labs

\
 
 \ /
  Last update: 2017-10-11 15:06    [W:1.894 / U:0.292 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site