diff options
| author |   Benoît Sevens <bsevens@google.com> | 2026-03-23 12:47:37 +0000 |
|---|---|---|
| committer |   Jiri Kosina <jkosina@suse.com> | 2026-04-09 17:54:42 +0200 |
| commit | 82a4fc46330910b4c1d9b189561439d468e3ff11 (patch) | |
| tree | 034a8d971d6c524cb7a49c000a95498b81d26ec6 /include/linux/bcma/ssh:/git@git.zx2c4.com | |
| parent | HID: usbhid: fix deadlock in hid_post_reset() (diff) | |
HID: playstation: validate num_touch_reports in DualShock 4 reports
The DualShock 4 HID driver fails to validate the num_touch_reports field
received from the device in both USB and Bluetooth input reports.
A malicious device could set this field to a value larger than the
allocated size of the touch_reports array (3 for USB, 4 for Bluetooth),
leading to an out-of-bounds read in dualshock4_parse_report().
This can result in kernel memory disclosure when processing malicious
HID reports.
Validate num_touch_reports against the array size for the respective
connection types before processing the touch data.
Signed-off-by: Benoît Sevens <bsevens@google.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Diffstat (limited to 'include/linux/bcma/ssh:/git@git.zx2c4.com')
0 files changed, 0 insertions, 0 deletions