Commit cac61b58 authored by T.J. Mercier's avatar T.J. Mercier Committed by Jiri Kosina
Browse files

HID: playstation: Clamp num_touch_reports 



A device would never lie about the number of touch reports would it?

If it does the loop in dualshock4_parse_report will read off the end of
the touch_reports array, up to about 2 KiB for the maximum number of 256
loop iteraions. The data that is read is emitted via evdev if the
DS4_TOUCH_POINT_INACTIVE bit happens to be set. Protect against this by
clamping the num_touch_reports value provided by the device to the
maximum size of the touch_reports array.

Fixes: 75203824 ("HID: playstation: add DualShock4 touchpad support.")
Cc: stable@vger.kernel.org
Reported-by: default avatarXingyu Jin <xingyuj@google.com>
Signed-off-by: default avatarT.J. Mercier <tjmercier@google.com>
Signed-off-by: default avatarJiri Kosina <jkosina@suse.com>
parent d93ba918

drivers/hid/hid-playstation.c

+4 −2
Original line number Diff line number Diff line
@@ -2384,7 +2384,8 @@ static int dualshock4_parse_report(struct ps_device *ps_dev, struct hid_report * 
		}



		ds4_report = &usb->common;

		num_touch_reports = usb->num_touch_reports;

		num_touch_reports = min_t(u8, usb->num_touch_reports,

					  ARRAY_SIZE(usb->touch_reports));

		touch_reports = usb->touch_reports;

	} else if (hdev->bus == BUS_BLUETOOTH && report->id == DS4_INPUT_REPORT_BT &&

		   size == DS4_INPUT_REPORT_BT_SIZE) {
@@ -2404,7 +2405,8 @@ static int dualshock4_parse_report(struct ps_device *ps_dev, struct hid_report * 
		}



		ds4_report = &bt->common;

		num_touch_reports = bt->num_touch_reports;

		num_touch_reports = min_t(u8, bt->num_touch_reports,

					  ARRAY_SIZE(bt->touch_reports));

		touch_reports = bt->touch_reports;

	} else if (hdev->bus == BUS_BLUETOOTH &&

		   report->id == DS4_INPUT_REPORT_BT_MINIMAL &&