diff options
| author | Hans de Goede <hdegoede@redhat.com> | 2013-10-29 09:06:54 +0100 |
|---|---|---|
| committer | Sarah Sharp <sarah.a.sharp@linux.intel.com> | 2014-03-04 15:38:18 -0800 |
| commit | d495c1baa1b3ba277bb5ae24adeab0600151cba4 (patch) | |
| tree | a6e6865ef95dfdbc41be9241939de1a969d3b552 /drivers/usb/storage/uas.c | |
| parent | 34f11e59c3d5d025ad9162d8fd126e0b7ca54f40 (diff) | |
| download | linux-d495c1baa1b3ba277bb5ae24adeab0600151cba4.tar.gz | |
uas: Fix bounds check in uas_find_endpoints
The loop uses up to 3 bytes of the endpoint extra data.
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Diffstat (limited to 'drivers/usb/storage/uas.c')
| -rw-r--r-- | drivers/usb/storage/uas.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c index 1ac66f290fbf7d..7662b3e13c4dc3 100644 --- a/drivers/usb/storage/uas.c +++ b/drivers/usb/storage/uas.c @@ -907,7 +907,7 @@ static int uas_find_endpoints(struct usb_host_interface *alt, for (i = 0; i < n_endpoints; i++) { unsigned char *extra = endpoint[i].extra; int len = endpoint[i].extralen; - while (len > 1) { + while (len >= 3) { if (extra[1] == USB_DT_PIPE_USAGE) { unsigned pipe_id = extra[2]; if (pipe_id > 0 && pipe_id < 5) |