diff options
| author | Camila Alvarez <[email protected]> | 2024-07-30 19:42:43 -0400 |
|---|---|---|
| committer | Jiri Kosina <[email protected]> | 2024-08-01 13:04:19 +0200 |
| commit | a6e9c391d45b5865b61e569146304cff72821a5d (patch) | |
| tree | 4871aacd6187bc9a542d53d712c51e6808163283 | |
| parent | facdbdfe0e6202d74758387ae9189c39f7b4b16c (diff) | |
HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup
report_fixup for the Cougar 500k Gaming Keyboard was not verifying
that the report descriptor size was correct before accessing it
Reported-by: [email protected]
Closes: https://syzkaller.appspot.com/bug?extid=24c0361074799d02c452
Signed-off-by: Camila Alvarez <[email protected]>
Reviewed-by: Silvan Jegen <[email protected]>
Signed-off-by: Jiri Kosina <[email protected]>
| -rw-r--r-- | drivers/hid/hid-cougar.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/hid/hid-cougar.c b/drivers/hid/hid-cougar.c index cb8bd8aae15b..0fa785f52707 100644 --- a/drivers/hid/hid-cougar.c +++ b/drivers/hid/hid-cougar.c @@ -106,7 +106,7 @@ static void cougar_fix_g6_mapping(void) static __u8 *cougar_report_fixup(struct hid_device *hdev, __u8 *rdesc, unsigned int *rsize) { - if (rdesc[2] == 0x09 && rdesc[3] == 0x02 && + if (*rsize >= 117 && rdesc[2] == 0x09 && rdesc[3] == 0x02 && (rdesc[115] | rdesc[116] << 8) >= HID_MAX_USAGES) { hid_info(hdev, "usage count exceeds max: fixing up report descriptor\n"); |