ChangeSet 1.1743.3.11, 2004/05/25 11:00:57-07:00, [EMAIL PROTECTED]
[PATCH] USB: out of bounds access in hiddev_cleanup
hiddev_table[] is an array of pointers. the minor number is used as an
offset. hiddev minors start either with zero, or with 96. If they start
with 96, the offset must be reduced by HIDDEV_MINOR_BASE because only 16
minors are available. unplugging a hiddevice will zero data outside the
hiddev_table array.
this was spotted by Takashi Iwai.
drivers/usb/input/hiddev.c | 2 +-
1 files changed, 1 insertion(+), 1 deletion(-)
diff -Nru a/drivers/usb/input/hiddev.c b/drivers/usb/input/hiddev.c
--- a/drivers/usb/input/hiddev.c Fri May 28 14:41:01 2004
+++ b/drivers/usb/input/hiddev.c Fri May 28 14:41:01 2004
@@ -232,7 +232,7 @@
static struct usb_class_driver hiddev_class;
static void hiddev_cleanup(struct hiddev *hiddev)
{
- hiddev_table[hiddev->hid->minor] = NULL;
+ hiddev_table[hiddev->hid->minor - HIDDEV_MINOR_BASE] = NULL;
usb_deregister_dev(hiddev->hid->intf, &hiddev_class);
kfree(hiddev);
}
-------------------------------------------------------
This SF.Net email is sponsored by: Oracle 10g
Get certified on the hottest thing ever to hit the market... Oracle 10g.
Take an Oracle 10g class now, and we'll give you the exam FREE.
http://ads.osdn.com/?ad_id149&alloc_id�66&op=click
_______________________________________________
[EMAIL PROTECTED]
To unsubscribe, use the last form field at:
https://lists.sourceforge.net/lists/listinfo/linux-usb-devel
