Re: [PATCH 1/4] usb: config->desc.bLength may not exceed amount of data returned by the device

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Sat, Aug 03, 2013 at 04:37:48PM +0200, Hans de Goede wrote:
> While reading the config parsing code I noticed this check is missing, without
> this check config->desc.wTotalLength can end up with a value larger then the
> dev->rawdescriptors length for the config, and when userspace then tries to
> get the rawdescriptors bad things may happen.

This would require a "broken" device configuration as the length is
determined from the descriptors themselves, not from userspace, but yes,
I agree it's good to have this check.

thanks,

greg k-h
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html




[Index of Archives]     [Linux Media]     [Linux Input]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]     [Old Linux USB Devel Archive]

  Powered by Linux