forked from luck/tmp_suning_uos_patched
83e526f2a2
OS descriptor head, when flagged as provided, is accessed without checking if it fits in provided buffer. Verify length before access. Also, there are other places where buffer length it checked after accessing offsets which are potentially past the end. Check buffer length before as well to fail cleanly. Signed-off-by: Vincent Pelletier <plr.vincent@gmail.com> Acked-by: Felipe Balbi <felipe.balbi@linux.intel.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|---|---|---|
| .. | ||
| function | ||
| legacy | ||
| udc | ||
| composite.c | ||
| config.c | ||
| configfs.c | ||
| configfs.h | ||
| epautoconf.c | ||
| functions.c | ||
| Kconfig | ||
| Makefile | ||
| u_f.c | ||
| u_f.h | ||
| u_os_desc.h | ||
| usbstring.c | ||