diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2021-02-17 12:21:10 -0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2021-03-03 17:44:41 +0100 |
| commit | e0154ded9330c188863b09824c3b07ebafa6e5a4 (patch) | |
| tree | ea640b600d08841fad7e3d5e64c4928fe6380b68 /drivers/clk | |
| parent | bdc2cea4998ad47a606a03a38dfdd8c6f73d08c8 (diff) | |
Input: joydev - prevent potential read overflow in ioctl
commit 182d679b2298d62bf42bb14b12a8067b8e17b617 upstream.
The problem here is that "len" might be less than "joydev->nabs" so the
loops which verfy abspam[i] and keypam[] might read beyond the buffer.
Fixes: 999b874f4aa3 ("Input: joydev - validate axis/button maps before clobbering current ones")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/YCyzR8WvFRw4HWw6@mwanda
[dtor: additional check for len being even in joydev_handle_JSIOCSBTNMAP]
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/clk')
0 files changed, 0 insertions, 0 deletions