diff options
| author | Mark Salyzyn <salyzyn@google.com> | 2018-01-16 13:42:30 -0800 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2018-07-25 02:01:34 -0700 |
| commit | 4d4a179e76a105a67746d6119a5417414bf009ce (patch) | |
| tree | 180c42088dee6fb70306b251cc9312dca8c5600a /kernel/irq/proc.c | |
| parent | df9023cd6928cca15905ae98b5ef7d857504d055 (diff) | |
ANDROID: Bluetooth: hidp: buffer overflow in hidp_process_report
The buffer length is unsigned at all layers, but gets cast to int and
checked in hidp_process_report and can lead to a buffer overflow.
Switch len parameter to unsigned int to resolve issue.
Signed-off-by: Mark Salyzyn <salyzyn@google.com>
Fixes: 678af93e46ac10318b54f2f0c9abbdfe75c4e078 ("HID: Bluetooth: hidp: make sure input buffers are big enough")
Bug: 65853588
Change-Id: I779ce783ae7c3bce8c5a66c0954ef31347e42cfc
Git-repo: https://android.googlesource.com/kernel/msm
Git-commit: 34c56d552bffcaefa84975bea0e55fb4481964fd
Signed-off-by: Srinivasa Rao Kuppala <srkupp@codeaurora.org>
Diffstat (limited to 'kernel/irq/proc.c')
0 files changed, 0 insertions, 0 deletions