[PATCH v2 8/8] HID: prodikeys: validate report size in raw_event callback

[Tristan Madani <tristmd@gmail.com>]

From: Tristan Madani <tristan@talencesecurity.com>

pcmidi_handle_report1() and pcmidi_handle_report4() read a 24-bit
bitmask from data[1..3] without verifying the report buffer is large
enough. Since hid-core invokes raw_event before validating the report
length in hid_report_raw_event(), the driver must check the buffer size
itself.

Add minimum size checks before calling pcmidi_handle_report1() and
pcmidi_handle_report4(). pcmidi_handle_report3() already handles
variable-length reports via its own size parameter and needs no
additional guard.

Fixes: 3a370ca1dcf8c ("HID: Prodikeys PC-MIDI HID Driver")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
 drivers/hid/hid-prodikeys.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/hid/hid-prodikeys.c b/drivers/hid/hid-prodikeys.c
index fba01e4fcab1c..925ca70f9cd4a 100644
--- a/drivers/hid/hid-prodikeys.c
+++ b/drivers/hid/hid-prodikeys.c
@@ -491,12 +491,16 @@ static int pcmidi_handle_report(
 
 	switch (report_id) {
 	case 0x01: /* midi keys (qwerty)*/
+		if (size < 4)
+			break;
 		ret = pcmidi_handle_report1(pm, data);
 		break;
 	case 0x03: /* midi keyboard (musical)*/
 		ret = pcmidi_handle_report3(pm, data, size);
 		break;
 	case 0x04: /* multimedia/midi keys (qwerty)*/
+		if (size < 4)
+			break;
 		ret = pcmidi_handle_report4(pm, data);
 		break;
 	}
-- 
2.47.3