Dan Carpenter 182d679b22 Input: joydev - prevent potential read overflow in ioctl
The problem here is that "len" might be less than "joydev->nabs" so the
loops which verfy abspam[i] and keypam[] might read beyond the buffer.

Fixes: 999b874f4aa3 ("Input: joydev - validate axis/button maps before clobbering current ones")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/YCyzR8WvFRw4HWw6@mwanda
[dtor: additional check for len being even in joydev_handle_JSIOCSBTNMAP]
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2021-02-19 11:02:16 -08:00
..
2020-09-04 13:19:19 -07:00
2020-08-02 18:26:51 +03:00
2020-09-20 15:18:11 -07:00
2020-07-27 11:49:37 +02:00
2020-11-17 18:13:23 -08:00
2020-09-15 16:20:43 -07:00
2020-08-29 12:37:00 -07:00
2020-08-05 19:24:27 -07:00
2020-09-21 19:49:15 -04:00
2020-09-24 09:05:04 -07:00
2020-08-28 10:15:33 -07:00
2020-09-13 08:52:21 -07:00
2020-10-08 18:48:34 -07:00
2020-10-02 14:48:25 -07:00
2020-09-29 17:21:54 +02:00
2020-11-17 18:13:23 -08:00
2020-10-09 11:38:07 -07:00
2020-08-14 16:00:09 -07:00
2020-09-25 15:16:01 -07:00
2020-09-26 11:01:18 -07:00
2020-10-09 18:05:12 -07:00
2020-10-02 14:42:13 -07:00
2020-09-15 13:52:14 +02:00
2020-09-25 16:53:02 +02:00
2020-10-06 12:38:28 +10:00