Commit 3a034a7a authored by Peter Wu's avatar Peter Wu Committed by Jiri Kosina

HID: logitech-hidpp: add boundary check for name retrieval

The HID response has a limited size. Do not trust the value returned by
hardware, check that it really fits in the message.
Signed-off-by: default avatarPeter Wu <peter@lekensteyn.nl>
Reviewed-by: default avatarBenjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
parent 1430ee73
...@@ -313,6 +313,9 @@ static char *hidpp_get_unifying_name(struct hidpp_device *hidpp_dev) ...@@ -313,6 +313,9 @@ static char *hidpp_get_unifying_name(struct hidpp_device *hidpp_dev)
len = response.rap.params[1]; len = response.rap.params[1];
if (2 + len > sizeof(response.rap.params))
return NULL;
name = kzalloc(len + 1, GFP_KERNEL); name = kzalloc(len + 1, GFP_KERNEL);
if (!name) if (!name)
return NULL; return NULL;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment