diff options
| author | Alan Stern <stern@rowland.harvard.edu> | 2016-08-01 15:25:56 -0400 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2016-09-07 08:32:39 +0200 |
| commit | 391738b9a371412a3c394975f18696d908971b69 (patch) | |
| tree | ff2406b5a08bc73b9035553cd387bd08685c2d6e /scripts/patch-kernel | |
| parent | 365a5f484c89142aceee3e9ff2968c8c017a3abf (diff) | |
USB: validate wMaxPacketValue entries in endpoint descriptors
commit aed9d65ac3278d4febd8665bd7db59ef53e825fe upstream.
Erroneous or malicious endpoint descriptors may have non-zero bits in
reserved positions, or out-of-bounds values. This patch helps prevent
these from causing problems by bounds-checking the wMaxPacketValue
entries in endpoint descriptors and capping the values at the maximum
allowed.
This issue was first discovered and tests were conducted by Jake Lamberson
<jake.lamberson1@gmail.com>, an intern working for Rosie Hall.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-by: roswest <roswest@cisco.com>
Tested-by: roswest <roswest@cisco.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'scripts/patch-kernel')
0 files changed, 0 insertions, 0 deletions