Commit 12bd440b authored by Rosalie Wanders's avatar Rosalie Wanders Committed by Jiri Kosina
Browse files

HID: sony: add missing size validation for Rock Band 3 Pro instruments 



This commit adds the missing size validation for Rock Band 3 PS3 Pro
instruments in sony_raw_event(), this prevents a malicious device from
allowing hid-sony to read out of bounds of the provided buffer.

Signed-off-by: default avatarRosalie Wanders <rosalie@mailbox.org>
Signed-off-by: default avatarJiri Kosina <jkosina@suse.com>
parent a4170b63

drivers/hid/hid-sony.c

+1 −1
Original line number Diff line number Diff line
@@ -1188,7 +1188,7 @@ static int sony_raw_event(struct hid_device *hdev, struct hid_report *report, 
	/* Rock Band 3 PS3 Pro instruments set rd[24] to 0xE0 when they're

	 * sending full reports, and 0x02 when only sending navigation.

	 */

	if ((sc->quirks & RB3_PRO_INSTRUMENT) && rd[24] == 0x02) {

	if ((sc->quirks & RB3_PRO_INSTRUMENT) && size >= 25 && rd[24] == 0x02) {

		/* Only attempt to enable full report every 8 seconds */

		if (time_after(jiffies, sc->rb3_pro_poke_jiffies)) {

			sc->rb3_pro_poke_jiffies = jiffies + secs_to_jiffies(8);