tag 1131fe69c702205af972eec37446f4db87ecf7f7
tagger The Android Open Source Project <initial-contribution@android.com> Wed Jul 25 13:30:01 2018 -0700
object 616eca606937955d31267871118a11a6c757b63a

Android daydreamos 8.0.0 Release 0.4

commit 616eca606937955d31267871118a11a6c757b63a
author Dmitry Torokhov <dmitry.torokhov@gmail.com> Mon Oct 23 16:46:00 2017 -0700
committer Mark Segal <segal@google.com> Wed Jun 13 14:52:06 2018 +0000
tree 26dd9dd8057790c137d60d871fd52b9d779d2b1c
parent e6e4561330a62813c89214cec18d289eaf922990

Input: gtco - fix potential out-of-bound access

commit a50829479f58416a013a4ccca791336af3c584c7 upstream.

parse_hid_report_descriptor() has a while (i < length) loop, which
only guarantees that there's at least 1 byte in the buffer, but the
loop body can read multiple bytes which causes out-of-bounds access.

Bug: 80547328
Change-Id: Ic6a2fda77685b90d7642c09b20f5d57d6d48b726
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Reviewed-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Siqi Lin <siqilin@google.com>
(cherry picked from commit 41079441cbc020fcbcc85564a223d4680c0c2ee0)