Commit d495c1ba authored by Hans de Goede's avatar Hans de Goede Committed by Sarah Sharp
Browse files

uas: Fix bounds check in uas_find_endpoints



The loop uses up to 3 bytes of the endpoint extra data.
Signed-off-by: default avatarHans de Goede <hdegoede@redhat.com>
Signed-off-by: default avatarSarah Sharp <sarah.a.sharp@linux.intel.com>
parent 34f11e59
......@@ -907,7 +907,7 @@ static int uas_find_endpoints(struct usb_host_interface *alt,
for (i = 0; i < n_endpoints; i++) {
unsigned char *extra = endpoint[i].extra;
int len = endpoint[i].extralen;
while (len > 1) {
while (len >= 3) {
if (extra[1] == USB_DT_PIPE_USAGE) {
unsigned pipe_id = extra[2];
if (pipe_id > 0 && pipe_id < 5)
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment