ded0acf2fb
commit 81cf4a45360f70528f1f64ba018d61cb5767249a upstream. As most of BOS descriptors are longer in length than their header 'struct usb_dev_cap_header', comparing solely with it is not sufficient to avoid out-of-bounds access to BOS descriptors. This patch adds descriptor type specific length check in usb_get_bos_descriptor() to fix the issue. Signed-off-by: Masakazu Mokuno <masakazu.mokuno@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> [bwh: Backported to 3.16: drop handling of USB_PTM_CAP_TYPE and USB_SSP_CAP_TYPE] Signed-off-by: Ben Hutchings <ben@decadent.org.uk> |
||
|---|---|---|
| .. | ||
| Kbuild | ||
| audio.h | ||
| ccid_bridge.h | ||
| cdc-wdm.h | ||
| cdc.h | ||
| ch9.h | ||
| ch11.h | ||
| f_accessory.h | ||
| f_mtp.h | ||
| functionfs.h | ||
| g_printer.h | ||
| gadgetfs.h | ||
| midi.h | ||
| msm_ext_chg.h | ||
| tmc.h | ||
| video.h | ||