iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

greybus: hid: fix missing input verification of report events

Browse Source 
Add minimal verification of incoming report size, before using it to
determine what buffer and size to pass on to HID core.

Add comment about protocol needing to be revisited. If we are going to
be parsing the report data received, then those fields have to be
defined in the Greybus specification at least.

Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>
This commit is contained in:
Johan Hovold 2015-03-27 12:45:47 +01:00 committed by Greg Kroah-Hartman
parent 36257f6b4e
commit 382145beb4
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/staging/greybus/hid.c
View File

@ -168,8 +168,12 @@ static void gb_hid_irq_handler(u8 type, struct gb_operation *op)
return;
}
/*
* FIXME: add report size to Greybus HID protocol if we need to parse
* it here.
*/
size = request->report[0] | request->report[1] << 8;
if (!size) {
if (size < 2 || size > op->request->payload_size - 2) {
dev_err(&connection->dev, "bad report size: %d\n", size);
return;
}