| From 81312d4a4d84ac8a6e073a897fc19561a9b52764 Mon Sep 17 00:00:00 2001 |
| From: Johan Hovold <johan@kernel.org> |
| Date: Thu, 16 Mar 2017 11:35:12 -0700 |
| Subject: [PATCH] Input: cm109 - validate number of endpoints before using them |
| |
| commit ac2ee9ba953afe88f7a673e1c0c839227b1d7891 upstream. |
| |
| Make sure to check the number of endpoints to avoid dereferencing a |
| NULL-pointer should a malicious device lack endpoints. |
| |
| Fixes: c04148f915e5 ("Input: add driver for USB VoIP phones with CM109...") |
| Signed-off-by: Johan Hovold <johan@kernel.org> |
| Cc: stable@vger.kernel.org # 2.6.28 |
| Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| |
| diff --git a/drivers/input/misc/cm109.c b/drivers/input/misc/cm109.c |
| index 9cc6d057c302..23c191a2a071 100644 |
| --- a/drivers/input/misc/cm109.c |
| +++ b/drivers/input/misc/cm109.c |
| @@ -700,6 +700,10 @@ static int cm109_usb_probe(struct usb_interface *intf, |
| int error = -ENOMEM; |
| |
| interface = intf->cur_altsetting; |
| + |
| + if (interface->desc.bNumEndpoints < 1) |
| + return -ENODEV; |
| + |
| endpoint = &interface->endpoint[0].desc; |
| |
| if (!usb_endpoint_is_int_in(endpoint)) |
| -- |
| 2.12.0 |
| |