HID: hiddev: validate num_values for HIDIOCGUSAGES, HIDIOCSUSAGES commands
authorScott Bauer <sbauer@plzdonthack.me>
Thu, 23 Jun 2016 14:59:47 +0000 (08:59 -0600)
committerBen Hutchings <ben@decadent.org.uk>
Mon, 22 Aug 2016 21:37:16 +0000 (22:37 +0100)
commit7cb5ee0e7e734969b39370ac739d473e0ae367bd
tree22538d1955dceb6c2ed0d61451428d73acf952a3
parent53056f82e9d762d0b260cdbcadfd5a10a262e047
HID: hiddev: validate num_values for HIDIOCGUSAGES, HIDIOCSUSAGES commands

commit 93a2001bdfd5376c3dc2158653034c20392d15c5 upstream.

This patch validates the num_values parameter from userland during the
HIDIOCGUSAGES and HIDIOCSUSAGES commands. Previously, if the report id was set
to HID_REPORT_ID_UNKNOWN, we would fail to validate the num_values parameter
leading to a heap overflow.

Signed-off-by: Scott Bauer <sbauer@plzdonthack.me>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
drivers/hid/usbhid/hiddev.c