Commit 2a3ac9ee authored by Muhammad Bilal's avatar Muhammad Bilal Committed by Luiz Augusto von Dentz
Browse files

Bluetooth: HIDP: fix missing length checks in hidp_input_report() 



hidp_input_report() reads keyboard and mouse payload data from an skb
without first verifying that skb->len contains enough data.

hidp_recv_intr_frame() pulls the 1-byte HIDP header before dispatching
to hidp_input_report(). If a paired device sends a truncated packet,
the handler reads beyond the valid skb data, resulting in an
out-of-bounds read of skb data. The OOB bytes may be interpreted as
phantom key presses or spurious mouse movement.

Replace the open-coded length tracking and pointer arithmetic with
skb_pull_data() calls. skb_pull_data() returns NULL if the requested
bytes are not present, eliminating the need for a manual size variable
and the separate skb->len guard.

Fixes: 1da177e4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarMuhammad Bilal <meatuni001@gmail.com>
Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
parent 8c8e6204

net/bluetooth/hidp/core.c

+18 −5
Original line number Diff line number Diff line
@@ -179,12 +179,21 @@ static void hidp_input_report(struct hidp_session *session, struct sk_buff *skb) 
{

	struct input_dev *dev = session->input;

	unsigned char *keys = session->keys;

	unsigned char *udata = skb->data + 1;

	signed char *sdata = skb->data + 1;

	int i, size = skb->len - 1;

	unsigned char *udata;

	signed char *sdata;

	u8 *hdr;

	int i;



	hdr = skb_pull_data(skb, 1);

	if (!hdr)

		return;



	switch (skb->data[0]) {

	switch (*hdr) {

	case 0x01:	/* Keyboard report */

		udata = skb_pull_data(skb, 8);

		if (!udata)

			break;



		for (i = 0; i < 8; i++)

			input_report_key(dev, hidp_keycode[i + 224], (udata[0] >> i) & 1);
@@ -213,6 +222,10 @@ static void hidp_input_report(struct hidp_session *session, struct sk_buff *skb) 
		break;



	case 0x02:	/* Mouse report */

		sdata = skb_pull_data(skb, 3);

		if (!sdata)

			break;



		input_report_key(dev, BTN_LEFT,   sdata[0] & 0x01);

		input_report_key(dev, BTN_RIGHT,  sdata[0] & 0x02);

		input_report_key(dev, BTN_MIDDLE, sdata[0] & 0x04);
@@ -222,7 +235,7 @@ static void hidp_input_report(struct hidp_session *session, struct sk_buff *skb) 
		input_report_rel(dev, REL_X, sdata[1]);

		input_report_rel(dev, REL_Y, sdata[2]);



		if (size > 3)

		if (skb->len > 0)

			input_report_rel(dev, REL_WHEEL, sdata[3]);

		break;

	}