From: Johan Hovold Date: Thu, 16 Mar 2017 18:34:02 +0000 (-0700) Subject: Input: iforce - validate number of endpoints before using them X-Git-Tag: release-20171130_firefly~4^2~100^2~1^2~20^2~62 X-Git-Url: http://demsky.eecs.uci.edu/git/?a=commitdiff_plain;h=a07d3669654ad335c19df048199da0a063e0c387;p=firefly-linux-kernel-4.4.55.git Input: iforce - validate number of endpoints before using them commit 59cf8bed44a79ec42303151dd014fdb6434254bb upstream. Make sure to check the number of endpoints to avoid dereferencing a NULL-pointer or accessing memory that lie beyond the end of the endpoint array should a malicious device lack the expected endpoints. Signed-off-by: Johan Hovold Signed-off-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman --- diff --git a/drivers/input/joystick/iforce/iforce-usb.c b/drivers/input/joystick/iforce/iforce-usb.c index d96aa27dfcdc..db64adfbe1af 100644 --- a/drivers/input/joystick/iforce/iforce-usb.c +++ b/drivers/input/joystick/iforce/iforce-usb.c @@ -141,6 +141,9 @@ static int iforce_usb_probe(struct usb_interface *intf, interface = intf->cur_altsetting; + if (interface->desc.bNumEndpoints < 2) + return -ENODEV; + epirq = &interface->endpoint[0].desc; epout = &interface->endpoint[1].desc;