81cf4a4536
As most of BOS descriptors are longer in length than their header 'struct usb_dev_cap_header', comparing solely with it is not sufficient to avoid out-of-bounds access to BOS descriptors. This patch adds descriptor type specific length check in usb_get_bos_descriptor() to fix the issue. Signed-off-by: Masakazu Mokuno <masakazu.mokuno@gmail.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
---|---|---|
.. | ||
audio.h | ||
cdc-wdm.h | ||
cdc.h | ||
ch9.h | ||
ch11.h | ||
charger.h | ||
functionfs.h | ||
g_printer.h | ||
gadgetfs.h | ||
midi.h | ||
tmc.h | ||
video.h |