From: Benjamin Tissoires Date: Wed, 11 Sep 2013 19:56:57 +0000 (+0200) Subject: HID: validate feature and input report details X-Git-Tag: v3.12-rc2~25^2~3 X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=cc6b54aa54bf40b762cab45a9fc8aa81653146eb;p=pandora-kernel.git HID: validate feature and input report details When dealing with usage_index, be sure to properly use unsigned instead of int to avoid overflows. When working on report fields, always validate that their report_counts are in bounds. Without this, a HID device could report a malicious feature report that could trick the driver into a heap overflow: [ 634.885003] usb 1-1: New USB device found, idVendor=0596, idProduct=0500 ... [ 676.469629] BUG kmalloc-192 (Tainted: G W ): Redzone overwritten CVE-2013-2897 Cc: stable@vger.kernel.org Signed-off-by: Benjamin Tissoires Acked-by: Kees Cook Signed-off-by: Jiri Kosina --- Reading git-diff-tree failed