diff options
| author | Vicki Pfau <vi@endrift.com> | 2023-12-20 06:38:36 +0300 |
|---|---|---|
| committer | Jiri Kosina <jkosina@suse.com> | 2024-01-02 13:20:43 +0300 |
| commit | 43565b6788d46820da7d8f5ab1a595398419e914 (patch) | |
| tree | e7ac8ed777fcc3d4dc55ade45d82ee80ebd313f2 /drivers/hid | |
| parent | 4f9a5a9769cc77075e606537e15747e8b8e9c7c9 (diff) | |
| download | linux-43565b6788d46820da7d8f5ab1a595398419e914.tar.xz | |
HID: hid-steam: Better handling of serial number length
The second byte of the GET_STRING_ATTRIB report is a length, so we should set
the size of the buffer to be the size we're actually requesting, and only
reject the reply if the length out is nonsensical.
Signed-off-by: Vicki Pfau <vi@endrift.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Diffstat (limited to 'drivers/hid')
| -rw-r--r-- | drivers/hid/hid-steam.c | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/drivers/hid/hid-steam.c b/drivers/hid/hid-steam.c index 4f5c647f04dd..a0ed8812e7ea 100644 --- a/drivers/hid/hid-steam.c +++ b/drivers/hid/hid-steam.c @@ -274,7 +274,7 @@ enum { }; /* Other random constants */ -#define STEAM_SERIAL_LEN 10 +#define STEAM_SERIAL_LEN 0x15 struct steam_device { struct list_head list; @@ -421,10 +421,10 @@ static int steam_get_serial(struct steam_device *steam) { /* * Send: 0xae 0x15 0x01 - * Recv: 0xae 0x15 0x01 serialnumber (10 chars) + * Recv: 0xae 0x15 0x01 serialnumber */ int ret = 0; - u8 cmd[] = {ID_GET_STRING_ATTRIBUTE, 0x15, ATTRIB_STR_UNIT_SERIAL}; + u8 cmd[] = {ID_GET_STRING_ATTRIBUTE, sizeof(steam->serial_no), ATTRIB_STR_UNIT_SERIAL}; u8 reply[3 + STEAM_SERIAL_LEN + 1]; mutex_lock(&steam->report_mutex); @@ -434,12 +434,13 @@ static int steam_get_serial(struct steam_device *steam) ret = steam_recv_report(steam, reply, sizeof(reply)); if (ret < 0) goto out; - if (reply[0] != ID_GET_STRING_ATTRIBUTE || reply[1] != 0x15 || reply[2] != ATTRIB_STR_UNIT_SERIAL) { + if (reply[0] != ID_GET_STRING_ATTRIBUTE || reply[1] < 1 || + reply[1] > sizeof(steam->serial_no) || reply[2] != ATTRIB_STR_UNIT_SERIAL) { ret = -EIO; goto out; } reply[3 + STEAM_SERIAL_LEN] = 0; - strscpy(steam->serial_no, reply + 3, sizeof(steam->serial_no)); + strscpy(steam->serial_no, reply + 3, reply[1]); out: mutex_unlock(&steam->report_mutex); return ret; |