diff options
| author | Mark Salyzyn <salyzyn@google.com> | 2018-01-16 13:42:30 -0800 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2018-07-25 02:01:34 -0700 |
| commit | 4d4a179e76a105a67746d6119a5417414bf009ce (patch) | |
| tree | 180c42088dee6fb70306b251cc9312dca8c5600a /net | |
| parent | df9023cd6928cca15905ae98b5ef7d857504d055 (diff) | |
ANDROID: Bluetooth: hidp: buffer overflow in hidp_process_report
The buffer length is unsigned at all layers, but gets cast to int and
checked in hidp_process_report and can lead to a buffer overflow.
Switch len parameter to unsigned int to resolve issue.
Signed-off-by: Mark Salyzyn <salyzyn@google.com>
Fixes: 678af93e46ac10318b54f2f0c9abbdfe75c4e078 ("HID: Bluetooth: hidp: make sure input buffers are big enough")
Bug: 65853588
Change-Id: I779ce783ae7c3bce8c5a66c0954ef31347e42cfc
Git-repo: https://android.googlesource.com/kernel/msm
Git-commit: 34c56d552bffcaefa84975bea0e55fb4481964fd
Signed-off-by: Srinivasa Rao Kuppala <srkupp@codeaurora.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/bluetooth/hidp/core.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c index f64de569175a..a295b5ec9d4a 100644 --- a/net/bluetooth/hidp/core.c +++ b/net/bluetooth/hidp/core.c @@ -431,8 +431,8 @@ static void hidp_del_timer(struct hidp_session *session) del_timer(&session->timer); } -static void hidp_process_report(struct hidp_session *session, - int type, const u8 *data, int len, int intr) +static void hidp_process_report(struct hidp_session *session, int type, + const u8 *data, unsigned int len, int intr) { if (len > HID_MAX_BUFFER_SIZE) len = HID_MAX_BUFFER_SIZE; |