diff options
| author |   Dmitry Torokhov <dmitry.torokhov@gmail.com> | 2026-05-22 21:42:39 -0700 |
|---|---|---|
| committer | Dmitry Torokhov <dmitry.torokhov@gmail.com> | 2026-06-06 21:05:17 -0700 |
| commit | d4579af29e67ca8722db0a1194227f8015c8981d (patch) | |
| tree | f23b127e1ec0e14be4f90b837c965779d76dbdc7 /tools/lib/python/kdoc/python_version.py | |
| parent | Input: ims-pcu - add response length checks (diff) | |
Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing
The driver parses CDC union descriptors in ims_pcu_get_cdc_union_desc()
by iterating through the extra descriptor data. However, it does not
verify that the bLength of each descriptor is at least 2. A malicious
device could provide a descriptor with bLength = 0, leading to an
infinite loop in the driver.
Add a check to ensure bLength is at least 2 before proceeding with
parsing.
Fixes: 628329d52474 (Input: add IMS Passenger Control Unit driver)
Cc: stable@vger.kernel.org
Assisted-by: Gemini:gemini-3.1-pro
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Diffstat (limited to 'tools/lib/python/kdoc/python_version.py')
0 files changed, 0 insertions, 0 deletions