From 55fece3439eec26747436d073c13b9bfa21c1f9e Mon Sep 17 00:00:00 2001 From: Sriharsha Allenki Date: Thu, 22 Dec 2016 14:57:44 +0530 Subject: [PATCH] hid: usbhid: Changes to prevent buffer overflow Moved some value checks to right positions to prevent buffer flow, which may be possible before. Previously these value checks are in an else statement which may not be executed. Change-Id: I02dbecd074183581a6bdae6377097bc004bd3d3c CRs-fixed: 1102936 Signed-off-by: Sriharsha Allenki --- drivers/hid/usbhid/hiddev.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c index 700145b15088..da8fd9580223 100644 --- a/drivers/hid/usbhid/hiddev.c +++ b/drivers/hid/usbhid/hiddev.c @@ -510,13 +510,13 @@ static noinline int hiddev_ioctl_usage(struct hiddev *hiddev, unsigned int cmd, goto inval; field = report->field[uref->field_index]; + } - if (cmd == HIDIOCGCOLLECTIONINDEX) { - if (uref->usage_index >= field->maxusage) - goto inval; - } else if (uref->usage_index >= field->report_count) + if (cmd == HIDIOCGCOLLECTIONINDEX) { + if (uref->usage_index >= field->maxusage) goto inval; - } + } else if (uref->usage_index >= field->report_count) + goto inval; if ((cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) && (uref_multi->num_values > HID_MAX_MULTI_USAGES || -- 2.11.0