HID: hiddev: validate num_values for HIDIOCGUSAGES, HIDIOCSUSAGES commands
authorScott Bauer <sbauer@plzdonthack.me>
Thu, 23 Jun 2016 14:59:47 +0000 (08:59 -0600)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 27 Jul 2016 16:47:32 +0000 (09:47 -0700)
commit300851ff55f7777be2780207f1b60ad5e1fd1303
tree5bd68f271c70366395563e892ced0e5247c70701
parent2d7a2ff18a99accba695b9208f36174a2983413a
HID: hiddev: validate num_values for HIDIOCGUSAGES, HIDIOCSUSAGES commands

commit 93a2001bdfd5376c3dc2158653034c20392d15c5 upstream.

This patch validates the num_values parameter from userland during the
HIDIOCGUSAGES and HIDIOCSUSAGES commands. Previously, if the report id was set
to HID_REPORT_ID_UNKNOWN, we would fail to validate the num_values parameter
leading to a heap overflow.

Signed-off-by: Scott Bauer <sbauer@plzdonthack.me>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/hid/usbhid/hiddev.c