Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-10-25 14:40:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

uas: Fix bounds check in uas_find_endpoints

Browse Source 
The loop uses up to 3 bytes of the endpoint extra data.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
This commit is contained in:
Hans de Goede 2013-10-29 09:06:54 +01:00 committed by Sarah Sharp
parent 34f11e59c3
commit d495c1baa1
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/usb/storage/uas.c
View File

@ -907,7 +907,7 @@ static int uas_find_endpoints(struct usb_host_interface *alt,
for (i = 0; i < n_endpoints; i++) {
unsigned char *extra = endpoint[i].extra;
int len = endpoint[i].extralen;
while (len > 1) {
while (len >= 3) {
if (extra[1] == USB_DT_PIPE_USAGE) {
unsigned pipe_id = extra[2];
if (pipe_id > 0 && pipe_id < 5)