From: Jiri Kosina Date: Thu, 21 Aug 2014 14:57:17 +0000 (-0500) Subject: HID: logitech: perform bounds checking on device_id early enough X-Git-Tag: omap-for-v3.17/fixes-against-rc2~28^2~1 X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ad3e14d7c5268c2e24477c6ef54bbdf88add5d36;p=pandora-kernel.git HID: logitech: perform bounds checking on device_id early enough device_index is a char type and the size of paired_dj_deivces is 7 elements, therefore proper bounds checking has to be applied to device_index before it is used. We are currently performing the bounds checking in logi_dj_recv_add_djhid_device(), which is too late, as malicious device could send REPORT_TYPE_NOTIF_DEVICE_UNPAIRED early enough and trigger the problem in one of the report forwarding functions called from logi_dj_raw_event(). Fix this by performing the check at the earliest possible ocasion in logi_dj_raw_event(). Cc: stable@vger.kernel.org Reported-by: Ben Hawkes Reviewed-by: Benjamin Tissoires Signed-off-by: Jiri Kosina --- Reading git-diff-tree failed