Masakazu Mokuno 81cf4a4536 USB: core: Add type-specific length check of BOS descriptors
As most of BOS descriptors are longer in length than their header
'struct usb_dev_cap_header', comparing solely with it is not sufficient
to avoid out-of-bounds access to BOS descriptors.

This patch adds descriptor type specific length check in
usb_get_bos_descriptor() to fix the issue.

Signed-off-by: Masakazu Mokuno <masakazu.mokuno@gmail.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-11-28 15:17:49 +01:00
..
2017-11-13 21:05:31 -08:00
2017-11-15 10:56:56 -08:00
2017-11-15 20:30:12 -08:00
2017-11-15 14:54:53 -08:00
2017-11-20 21:50:24 -10:00
2017-11-16 13:06:27 -08:00