Commit 43565b67 authored by Vicki Pfau's avatar Vicki Pfau Committed by Jiri Kosina
Browse files

HID: hid-steam: Better handling of serial number length 



The second byte of the GET_STRING_ATTRIB report is a length, so we should set
the size of the buffer to be the size we're actually requesting, and only
reject the reply if the length out is nonsensical.

Signed-off-by: default avatarVicki Pfau <vi@endrift.com>
Signed-off-by: default avatarJiri Kosina <jkosina@suse.com>
parent 4f9a5a97

drivers/hid/hid-steam.c

+6 −5
Original line number Diff line number Diff line
@@ -274,7 +274,7 @@ enum { 
};



/* Other random constants */

#define STEAM_SERIAL_LEN 10

#define STEAM_SERIAL_LEN 0x15



struct steam_device {

	struct list_head list;
@@ -421,10 +421,10 @@ static int steam_get_serial(struct steam_device *steam) 
{

	/*

	 * Send: 0xae 0x15 0x01

	 * Recv: 0xae 0x15 0x01 serialnumber (10 chars)

	 * Recv: 0xae 0x15 0x01 serialnumber

	 */

	int ret = 0;

	u8 cmd[] = {ID_GET_STRING_ATTRIBUTE, 0x15, ATTRIB_STR_UNIT_SERIAL};

	u8 cmd[] = {ID_GET_STRING_ATTRIBUTE, sizeof(steam->serial_no), ATTRIB_STR_UNIT_SERIAL};

	u8 reply[3 + STEAM_SERIAL_LEN + 1];



	mutex_lock(&steam->report_mutex);
@@ -434,12 +434,13 @@ static int steam_get_serial(struct steam_device *steam) 
	ret = steam_recv_report(steam, reply, sizeof(reply));

	if (ret < 0)

		goto out;

	if (reply[0] != ID_GET_STRING_ATTRIBUTE || reply[1] != 0x15 || reply[2] != ATTRIB_STR_UNIT_SERIAL) {

	if (reply[0] != ID_GET_STRING_ATTRIBUTE || reply[1] < 1 ||

	    reply[1] > sizeof(steam->serial_no) || reply[2] != ATTRIB_STR_UNIT_SERIAL) {

		ret = -EIO;

		goto out;

	}

	reply[3 + STEAM_SERIAL_LEN] = 0;

	strscpy(steam->serial_no, reply + 3, sizeof(steam->serial_no));

	strscpy(steam->serial_no, reply + 3, reply[1]);

out:

	mutex_unlock(&steam->report_mutex);

	return ret;