Commit 22638375 authored by K. Y. Srinivasan's avatar K. Y. Srinivasan Committed by Greg Kroah-Hartman
Browse files

Staging: hv: mousevsc: Add a check to prevent memory corruption 



Add a check to prevent memory corruption.

Signed-off-by: default avatarK. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent dba8e1ad

drivers/staging/hv/hv_mouse.c

+12 −0
Original line number Diff line number Diff line
@@ -274,6 +274,18 @@ static void mousevsc_on_receive(struct hv_device *device, 


	switch (hid_msg->header.type) {

	case SYNTH_HID_PROTOCOL_RESPONSE:

		/*

		 * While it will be impossible for us to protect against

		 * malicious/buggy hypervisor/host, add a check here to

		 * ensure we don't corrupt memory.

		 */

		if ((pipe_msg->size + sizeof(struct pipe_prt_msg)

			- sizeof(unsigned char))

			> sizeof(struct mousevsc_prt_msg)) {

			WARN_ON(1);

			break;

		}



		memcpy(&input_dev->protocol_resp, pipe_msg,

		       pipe_msg->size + sizeof(struct pipe_prt_msg) -

		       sizeof(unsigned char));