Skip to content
Commit 38158384 authored by Harshit Mogalapalli's avatar Harshit Mogalapalli Committed by Jiri Kosina
Browse files

HID: cp2112: prevent a buffer overflow in cp2112_xfer()



Smatch warnings:
drivers/hid/hid-cp2112.c:793 cp2112_xfer() error: __memcpy()
'data->block[1]' too small (33 vs 255)
drivers/hid/hid-cp2112.c:793 cp2112_xfer() error: __memcpy() 'buf' too
small (64 vs 255)

The 'read_length' variable is provided by 'data->block[0]' which comes
from user and it(read_length) can take a value between 0-255. Add an
upper bound to 'read_length' variable to prevent a buffer overflow in
memcpy().

Fixes: 542134c0 ("HID: cp2112: Fix I2C_BLOCK_DATA transactions")
Signed-off-by: default avatarHarshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
parent db925d80
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment