diff options
| author | Dmitry Torokhov <dmitry.torokhov@gmail.com> | 2017-10-23 16:46:00 -0700 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2017-11-26 13:51:11 +0000 |
| commit | 2de544fd1b16f76f8dd1213d585ce611155ccd34 (patch) | |
| tree | 33defab3415d10e811c3c1d68e4050881ee716bd /lib/string_helpers.c | |
| parent | 0df873c63e8e99a8fb6e068d182b860e6e6e07a9 (diff) | |
Input: gtco - fix potential out-of-bound access
commit a50829479f58416a013a4ccca791336af3c584c7 upstream.
parse_hid_report_descriptor() has a while (i < length) loop, which
only guarantees that there's at least 1 byte in the buffer, but the
loop body can read multiple bytes which causes out-of-bounds access.
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Reviewed-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
[bwh: Backported to 3.2: use &device->usbdev->dev as the device for dev_err()]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Diffstat (limited to 'lib/string_helpers.c')
0 files changed, 0 insertions, 0 deletions