]> www.infradead.org Git - users/dwmw2/linux.git/commit
Input: gtco - bounds check collection indent level
authorGrant Hernandez <granthernandez@google.com>
Sat, 13 Jul 2019 08:00:12 +0000 (01:00 -0700)
committerBen Hutchings <ben@decadent.org.uk>
Tue, 13 Aug 2019 11:39:25 +0000 (12:39 +0100)
commit754d0ca82fed0ad682e875bea824c348d597ca28
tree41c06a2a04fa2e2d314425d2cff8de6eae74ef19
parentebb8302ce770e8c455d9209cb598f4cd03021e42
Input: gtco - bounds check collection indent level

commit 2a017fd82c5402b3c8df5e3d6e5165d9e6147dc1 upstream.

The GTCO tablet input driver configures itself from an HID report sent
via USB during the initial enumeration process. Some debugging messages
are generated during the parsing. A debugging message indentation
counter is not bounds checked, leading to the ability for a specially
crafted HID report to cause '-' and null bytes be written past the end
of the indentation array. As long as the kernel has CONFIG_DYNAMIC_DEBUG
enabled, this code will not be optimized out.  This was discovered
during code review after a previous syzkaller bug was found in this
driver.

Signed-off-by: Grant Hernandez <granthernandez@google.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
drivers/input/tablet/gtco.c