diff options
| author | Maulik Mankad <maulik@ti.com> | 2011-01-13 13:49:56 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2011-01-23 03:53:27 +0100 |
| commit | 3c47eb06f08eb970ea9d696bcdb57a175d37b470 (patch) | |
| tree | 9cc8df6c428c7973caa5b28e19ffc75622ef2c6a /drivers/usb | |
| parent | USB: serial: handle Data Carrier Detect changes (diff) | |
| download | linux-3c47eb06f08eb970ea9d696bcdb57a175d37b470.tar.xz linux-3c47eb06f08eb970ea9d696bcdb57a175d37b470.zip | |
usb: gadget: composite: avoid access beyond array max length
One of the USB CV MSC tests issues Get Max LUN request with
invalid wIndex (wIndex = 65535) parameter.
Add proper handling to prevent array index out of bounds issue.
Signed-off-by: Maulik Mankad <maulik@ti.com>
Cc: David Brownell <david-b@pacbell.net>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers/usb')
| -rw-r--r-- | drivers/usb/gadget/composite.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c index f6ff8456d52d..1ba4befe336b 100644 --- a/drivers/usb/gadget/composite.c +++ b/drivers/usb/gadget/composite.c @@ -928,8 +928,9 @@ unknown: */ switch (ctrl->bRequestType & USB_RECIP_MASK) { case USB_RECIP_INTERFACE: - if (cdev->config) - f = cdev->config->interface[intf]; + if (!cdev->config || w_index >= MAX_CONFIG_INTERFACES) + break; + f = cdev->config->interface[intf]; break; case USB_RECIP_ENDPOINT: |