]> git.proxmox.com Git - mirror_ubuntu-zesty-kernel.git/commit
cdc-acm: fix possible invalid access when processing notification
authorTobias Herzog <t-herzog@gmx.de>
Thu, 30 Mar 2017 20:15:10 +0000 (22:15 +0200)
committerKleber Sacilotto de Souza <kleber.souza@canonical.com>
Tue, 20 Jun 2017 10:18:02 +0000 (12:18 +0200)
commitcdb17d88fff293bd5f1f8f17535443c0248fde10
tree84ca84a765627a3d43a0a2255f9ef9413157aa14
parentdf7d567ccbcc526eed95cf70ff5125b86372909c
cdc-acm: fix possible invalid access when processing notification

BugLink: http://bugs.launchpad.net/bugs/1694621
commit 1bb9914e1730417d530de9ed37e59efdc647146b upstream.

Notifications may only be 8 bytes long. Accessing the 9th and
10th byte of unimplemented/unknown notifications may be insecure.
Also check the length of known notifications before accessing anything
behind the 8th byte.

Signed-off-by: Tobias Herzog <t-herzog@gmx.de>
Acked-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
drivers/usb/class/cdc-acm.c