[PATCH 17/47] Fix boundary checks for GUSAGE/SUSAGE in hiddev.

Vojtech Pavlik
2004-07-29T14:26:36Z

ChangeSet@1.1722.117.4, 2004-06-06 11:37:43+02:00, herbert@gondor.apana.org.au
input: Fix boundary checks for GUSAGE/SUSAGE in hiddev.

Signed-off-by: Vojtech Pavlik <vojtech@suse.cz>

hiddev.c | 20 +++++++++++++-------
1 files changed, 13 insertions(+), 7 deletions(-)

===================================================================

diff -Nru a/drivers/usb/input/hiddev.c b/drivers/usb/input/hiddev.c
--- a/drivers/usb/input/hiddev.c Thu Jul 29 14:41:02 2004
+++ b/drivers/usb/input/hiddev.c Thu Jul 29 14:41:02 2004
@@ -638,16 +638,22 @@
goto inval;

field = report->field[uref->field_index];
- if (uref->usage_index >= field->maxusage)
- goto inval;

- if (cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) {
- if (uref_multi->num_values >= HID_MAX_MULTI_USAGES ||
- uref->usage_index >= field->maxusage ||
- (uref->usage_index + uref_multi->num_values) >= field->maxusage)
+ if (cmd == HIDIOCGCOLLECTIONINDEX) {
+ if (uref->usage_index >= field->maxusage)
goto inval;
+ } else if (uref->usage_index >= field->report_count)
+ goto inval;
+
+ else if ((cmd == HIDIOCGUSAGES ||
+ cmd == HIDIOCSUSAGES) &&
+ (uref->usage_index + uref_multi->num_values >=
+ field->report_count ||
+ uref->usage_index + uref_multi->num_values <
+ uref->usage_index))
+ goto inval;
+
}
- }

switch (cmd) {