A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-29 03:01:39 -04:00
Code Issues Projects Releases Packages Wiki Activity

HID: picolcd_core: validate output report details

Browse source 
A HID device could send a malicious output report that would cause the
picolcd HID driver to trigger a NULL dereference during attr file writing.

[[email protected]: changed

	report->maxfield < 1

to

	report->maxfield != 1

as suggested by Bruno].

CVE-2013-2899

Signed-off-by: Kees Cook <[email protected]>
Cc: [email protected]
Reviewed-by: Bruno Prémont <[email protected]>
Acked-by: Bruno Prémont <[email protected]>
Signed-off-by: Jiri Kosina <[email protected]>
This commit is contained in:
Kees Cook 2013-08-28 22:31:52 +02:00 • committed by Jiri Kosina
commit 1e87a2456b
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
drivers/hid/hid-picolcd_core.c
View file

@ -290,7 +290,7 @@ static ssize_t picolcd_operation_mode_store(struct device *dev,
buf += 10;
cnt -= 10;
}
if (!report)
if (!report || report->maxfield != 1)
return -EINVAL;
while (cnt > 0 && (buf[cnt-1] == '\n' || buf[cnt-1] == '\r'))