| From: Johan Hovold <johan@kernel.org> |
| Date: Thu, 16 Mar 2017 11:36:13 -0700 |
| Subject: Input: ims-pcu - validate number of endpoints before using them |
| |
| commit 1916d319271664241b7aa0cd2b05e32bdb310ce9 upstream. |
| |
| Make sure to check the number of endpoints to avoid dereferencing a |
| NULL-pointer should a malicious device lack control-interface endpoints. |
| |
| Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver") |
| Signed-off-by: Johan Hovold <johan@kernel.org> |
| Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> |
| Signed-off-by: Ben Hutchings <ben@decadent.org.uk> |
| --- |
| drivers/input/misc/ims-pcu.c | 4 ++++ |
| 1 file changed, 4 insertions(+) |
| |
| --- a/drivers/input/misc/ims-pcu.c |
| +++ b/drivers/input/misc/ims-pcu.c |
| @@ -1667,6 +1667,10 @@ static int ims_pcu_parse_cdc_data(struct |
| return -EINVAL; |
| |
| alt = pcu->ctrl_intf->cur_altsetting; |
| + |
| + if (alt->desc.bNumEndpoints < 1) |
| + return -ENODEV; |
| + |
| pcu->ep_ctrl = &alt->endpoint[0].desc; |
| pcu->max_ctrl_size = usb_endpoint_maxp(pcu->ep_ctrl); |
| |
