Unnamed repository; edit this file 'description' to name the repository. https://gitea.privatedns.org/xavi/android_kernel_m2note/atom?h=ng-7.1.2 2018-05-16T11:09:07+00:00 2018-05-16T11:09:07+00:00 Marissa Wall marissaw@google.com 2017-11-16T22:32:40+00:00 urn:sha1:67d144f83962dd0094fe022d45e4913c611658b7 Andrey Konovalov reported a possible out-of-bounds problem for the cdc_parse_cdc_header function. He writes: It looks like cdc_parse_cdc_header() doesn't validate buflen before accessing buffer[1], buffer[2] and so on. The only check present is while (buflen > 0). So fix this issue up by properly validating the buffer length matches what the descriptor says it is. (cherry picked from commit 2e1c42391ff2556387b3cb6308b24f6f65619feb) (The original patch fixed the generic cdc_parser_cdc_header function. That generic function did not exist in 3.10 but there are a couple cdc parsers that suffer from the same underlying problem.) Bug: 69052594 Change-Id: Ib251469de39e51b0ed7c1a1b88873270afccd90f Reported-by: Andrey Konovalov <andreyknvl@google.com> Tested-by: Andrey Konovalov <andreyknvl@google.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Marissa Wall <marissaw@google.com> 2016-08-26T14:15:25+00:00 Jan Engelmohr jan.engelmohr@mailbox.tu-dresden.de 2016-08-01T11:31:29+00:00 urn:sha1:97ef32aefecf27ce57455ac16a2da18ac7e2c1d6 2016-08-15T02:19:42+00:00 Meizu OpenSource patchwork@meizu.com 2016-08-15T02:19:42+00:00 urn:sha1:d2e1446d81725c351dc73a03b397ce043fb18452