hollalinux
/
linux-sg2042
mirror of https://github.com/sophgo/linux-riscv.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

uas: Fix bounds check in uas_find_endpoints 

The loop uses up to 3 bytes of the endpoint extra data.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
This commit is contained in:
Hans de Goede 2013-10-29 09:06:54 +01:00 committed by Sarah Sharp
parent 34f11e59c3
commit d495c1baa1
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/usb/storage/uas.c
View File

@ -907,7 +907,7 @@ static int uas_find_endpoints(struct usb_host_interface *alt,
for (i = 0; i < n_endpoints; i++) {
unsigned char *extra = endpoint[i].extra;
int len = endpoint[i].extralen;
while (len > 1) {
while (len >= 3) {
if (extra[1] == USB_DT_PIPE_USAGE) {
unsigned pipe_id = extra[2];
if (pipe_id > 0 && pipe_id < 5)