---

yaml --- r: 281025 b: refs/heads/master c: 2263837 h: refs/heads/master i: 281023: 33fb845 v: v3
git-mirror · Nov 27, 2011 · 2ba93a6 · 2ba93a6
1 parent 33d15e9
commit 2ba93a6
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 1 deletion.
diff --git a/[refs] b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: dba8e1ad957e19ab42c39808a502803dc5b2dee7
+refs/heads/master: 226383751ff3ce67a648653e8bfe0842f36bbf96
diff --git a/trunk/drivers/staging/hv/hv_mouse.c b/trunk/drivers/staging/hv/hv_mouse.c
@@ -274,6 +274,18 @@ static void mousevsc_on_receive(struct hv_device *device,
 
 	switch (hid_msg->header.type) {
 	case SYNTH_HID_PROTOCOL_RESPONSE:
+		/*
+		 * While it will be impossible for us to protect against
+		 * malicious/buggy hypervisor/host, add a check here to
+		 * ensure we don't corrupt memory.
+		 */
+		if ((pipe_msg->size + sizeof(struct pipe_prt_msg)
+			- sizeof(unsigned char))
+			> sizeof(struct mousevsc_prt_msg)) {
+			WARN_ON(1);
+			break;
+		}
+
 		memcpy(&input_dev->protocol_resp, pipe_msg,
 		       pipe_msg->size + sizeof(struct pipe_prt_msg) -
 		       sizeof(unsigned char));