[PATCH 8/8] HID: prodikeys: validate report size in raw_event callback

[Tristan Madani <tristmd@gmail.com>]

From: Tristan Madani <tristan@talencesecurity.com>

pk_raw_event() accesses data[0] through data[3] without verifying
the report buffer is large enough. Since hid-core invokes raw_event
before validating the report length in hid_report_raw_event(), the
driver must check the buffer size itself.

Add a minimum size check at the start of pk_raw_event() so that
short reports are dropped before any field is accessed.

Fixes: 3a370ca1dcf8c ("HID: Prodikeys PC-MIDI HID Driver")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
 drivers/hid/hid-prodikeys.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/hid/hid-prodikeys.c b/drivers/hid/hid-prodikeys.c
index fba01e4fcab1c..c1419e6703777 100644
--- a/drivers/hid/hid-prodikeys.c
+++ b/drivers/hid/hid-prodikeys.c
@@ -768,6 +768,9 @@ static int pk_raw_event(struct hid_device *hdev, struct hid_report *report,
 	struct pcmidi_snd *pm = hid_get_drvdata(hdev);
 	int ret = 0;
 
+	if (size < 4)
+		return 0;
+
 	if (1 == pm->ifnum) {
 		if (report->id == data[0])
 			switch (report->id) {
-- 
2.47.3