]> www.infradead.org Git - users/jedix/linux-maple.git/commit
HID: hiddev: validate num_values for HIDIOCGUSAGES, HIDIOCSUSAGES commands
authorScott Bauer <sbauer@plzdonthack.me>
Thu, 23 Jun 2016 14:59:47 +0000 (08:59 -0600)
committerChuck Anderson <chuck.anderson@oracle.com>
Wed, 5 Oct 2016 19:24:48 +0000 (12:24 -0700)
commiteb067681aa2c367212cf064217d474389ae2545b
tree44ac6f84de1159af562002f7224909556c60625d
parentedd10f49932acce4f0e2af02f61344f73553f42c
HID: hiddev: validate num_values for HIDIOCGUSAGES, HIDIOCSUSAGES commands

Orabug: 24798688
CVE: CVE-2016-5829

This patch validates the num_values parameter from userland during the
HIDIOCGUSAGES and HIDIOCSUSAGES commands. Previously, if the report id was set
to HID_REPORT_ID_UNKNOWN, we would fail to validate the num_values parameter
leading to a heap overflow.

Cc: stable@vger.kernel.org
Signed-off-by: Scott Bauer <sbauer@plzdonthack.me>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
(cherry picked from commit 93a2001bdfd5376c3dc2158653034c20392d15c5)
Signed-off-by: Brian Maly <brian.maly@oracle.com>
drivers/hid/usbhid/hiddev.c