Commit 38158384 authored Jun 08, 2022 by Harshit Mogalapalli Committed by Jiri Kosina Jun 09, 2022

HID: cp2112: prevent a buffer overflow in cp2112_xfer()



Smatch warnings:
drivers/hid/hid-cp2112.c:793 cp2112_xfer() error: __memcpy()
'data->block[1]' too small (33 vs 255)
drivers/hid/hid-cp2112.c:793 cp2112_xfer() error: __memcpy() 'buf' too
small (64 vs 255)

The 'read_length' variable is provided by 'data->block[0]' which comes
from user and it(read_length) can take a value between 0-255. Add an
upper bound to 'read_length' variable to prevent a buffer overflow in
memcpy().

Fixes: 542134c0 ("HID: cp2112: Fix I2C_BLOCK_DATA transactions")
Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

parent db925d80

drivers/hid/hid-cp2112.c

+5 −0

Original line number	Diff line number	Diff line
		@@ -790,6 +790,11 @@ static int cp2112_xfer(struct i2c_adapter *adap, u16 addr,
		data->word = le16_to_cpup((__le16 *)buf);
		break;
		case I2C_SMBUS_I2C_BLOCK_DATA:
		if (read_length > I2C_SMBUS_BLOCK_MAX) {
		ret = -EINVAL;
		goto power_normal;
		}

		memcpy(data->block + 1, buf, read_length);
		break;
		case I2C_SMBUS_BLOCK_DATA: