A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-30 19:51:31 -04:00
Code Issues Projects Releases Packages Wiki Activity

HID: sensor-hub: validate feature report details

Browse source 
A HID device could send a malicious feature report that would cause the
sensor-hub HID driver to read past the end of heap allocation, leaking
kernel memory contents to the caller.

CVE-2013-2898

Signed-off-by: Kees Cook <[email protected]>
Cc: [email protected]
Reviewed-by: Mika Westerberg <[email protected]>
Signed-off-by: Jiri Kosina <[email protected]>
This commit is contained in:
Kees Cook 2013-08-28 22:31:44 +02:00 • committed by Jiri Kosina
commit 9e89102573
1 changed files with 2 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
drivers/hid/hid-sensor-hub.c
View file

@ -221,7 +221,8 @@ int sensor_hub_get_feature(struct hid_sensor_hub_device *hsdev, u32 report_id,
mutex_lock(&data->mutex);
report = sensor_hub_report(report_id, hsdev->hdev, HID_FEATURE_REPORT);
if (!report || (field_index >= report->maxfield)) {
if (!report || (field_index >= report->maxfield) ||
report->field[field_index]->report_count < 1) {
ret = -EINVAL;
goto done_proc;
}