mirror of
https://github.com/team-infusion-developers/android_kernel_samsung_msm8976.git
synced 2024-11-07 04:09:21 +00:00
e830011278
parse_hid_report_descriptor() has a while (i < length) loop, which only guarantees that there's at least 1 byte in the buffer, but the loop body can read multiple bytes which causes out-of-bounds access. Reported-by: Andrey Konovalov <andreyknvl@google.com> Reviewed-by: Andrey Konovalov <andreyknvl@google.com> Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Change-Id: I7b57556c100d28d8f10c03ea5480224e770fb64a Git-commit: a50829479f58416a013a4ccca791336af3c584c7 Git-repo: https://android.googlesource.com/kernel/common Signed-off-by: Srinivasa Rao Kuppala <srkupp@codeaurora.org> |
||
---|---|---|
.. | ||
acecad.c | ||
aiptek.c | ||
gtco.c | ||
hanwang.c | ||
kbtab.c | ||
Kconfig | ||
Makefile | ||
wacom.h | ||
wacom_sys.c | ||
wacom_wac.c | ||
wacom_wac.h |