Commit 182d679b authored by Dan Carpenter's avatar Dan Carpenter Committed by Dmitry Torokhov

Input: joydev - prevent potential read overflow in ioctl

The problem here is that "len" might be less than "joydev->nabs" so the
loops which verfy abspam[i] and keypam[] might read beyond the buffer.

Fixes: 999b874f ("Input: joydev - validate axis/button maps before clobbering current ones")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/YCyzR8WvFRw4HWw6@mwanda
[dtor: additional check for len being even in joydev_handle_JSIOCSBTNMAP]
Cc: stable@vger.kernel.org
Signed-off-by: default avatarDmitry Torokhov <dmitry.torokhov@gmail.com>
parent 0958351e
...@@ -456,7 +456,7 @@ static int joydev_handle_JSIOCSAXMAP(struct joydev *joydev, ...@@ -456,7 +456,7 @@ static int joydev_handle_JSIOCSAXMAP(struct joydev *joydev,
if (IS_ERR(abspam)) if (IS_ERR(abspam))
return PTR_ERR(abspam); return PTR_ERR(abspam);
for (i = 0; i < joydev->nabs; i++) { for (i = 0; i < len && i < joydev->nabs; i++) {
if (abspam[i] > ABS_MAX) { if (abspam[i] > ABS_MAX) {
retval = -EINVAL; retval = -EINVAL;
goto out; goto out;
...@@ -480,6 +480,9 @@ static int joydev_handle_JSIOCSBTNMAP(struct joydev *joydev, ...@@ -480,6 +480,9 @@ static int joydev_handle_JSIOCSBTNMAP(struct joydev *joydev,
int i; int i;
int retval = 0; int retval = 0;
if (len % sizeof(*keypam))
return -EINVAL;
len = min(len, sizeof(joydev->keypam)); len = min(len, sizeof(joydev->keypam));
/* Validate the map. */ /* Validate the map. */
...@@ -487,7 +490,7 @@ static int joydev_handle_JSIOCSBTNMAP(struct joydev *joydev, ...@@ -487,7 +490,7 @@ static int joydev_handle_JSIOCSBTNMAP(struct joydev *joydev,
if (IS_ERR(keypam)) if (IS_ERR(keypam))
return PTR_ERR(keypam); return PTR_ERR(keypam);
for (i = 0; i < joydev->nkey; i++) { for (i = 0; i < (len / 2) && i < joydev->nkey; i++) {
if (keypam[i] > KEY_MAX || keypam[i] < BTN_MISC) { if (keypam[i] > KEY_MAX || keypam[i] < BTN_MISC) {
retval = -EINVAL; retval = -EINVAL;
goto out; goto out;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment