Commit 9ccad2df authored by Johan Hovold's avatar Johan Hovold Committed by Greg Kroah-Hartman

Input: sur40 - validate number of endpoints before using them

commit 92461f5d upstream.

Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer or accessing memory that lie beyond the end of the endpoint
array should a malicious device lack the expected endpoints.

Fixes: bdb5c57f ("Input: add sur40 driver for Samsung SUR40... ")
Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
Signed-off-by: default avatarDmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent fb50058c
...@@ -527,6 +527,9 @@ static int sur40_probe(struct usb_interface *interface, ...@@ -527,6 +527,9 @@ static int sur40_probe(struct usb_interface *interface,
if (iface_desc->desc.bInterfaceClass != 0xFF) if (iface_desc->desc.bInterfaceClass != 0xFF)
return -ENODEV; return -ENODEV;
if (iface_desc->desc.bNumEndpoints < 5)
return -ENODEV;
/* Use endpoint #4 (0x86). */ /* Use endpoint #4 (0x86). */
endpoint = &iface_desc->endpoint[4].desc; endpoint = &iface_desc->endpoint[4].desc;
if (endpoint->bEndpointAddress != TOUCH_ENDPOINT) if (endpoint->bEndpointAddress != TOUCH_ENDPOINT)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment