input: CVE-2017-16643

Input: gtco - fix potential out-of-bound access

References:
https://nvd.nist.gov/vuln/detail/CVE-2017-16643
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a50829479f58416a013a4ccca791336af3c584c7
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-4.1.y&id=52f65e35c2b85908fa66cfc265be4e3fd88744a3

Change-Id: I24cfded743d99eade9048ef89b6e9bbd3db0510e
Signed-off-by: Adrian Stratulat <adrian.stratulat@enea.com>

1 files changed, 63 insertions, 0 deletions

diff --git a/patches/cve/CVE-2017-16643.patch b/patches/cve/CVE-2017-16643.patch
new file mode 100644
index 0000000..2be1c82
--- /dev/null
+++ b/patches/cve/CVE-2017-16643.patch
@@ -0,0 +1,63 @@
+From 52f65e35c2b85908fa66cfc265be4e3fd88744a3 Mon Sep 17 00:00:00 2001
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Date: Mon, 23 Oct 2017 16:46:00 -0700
+Subject: Input: gtco - fix potential out-of-bound access
+
+commit a50829479f58416a013a4ccca791336af3c584c7 upstream.
+
+parse_hid_report_descriptor() has a while (i < length) loop, which
+only guarantees that there's at least 1 byte in the buffer, but the
+loop body can read multiple bytes which causes out-of-bounds access.
+
+Upstream-Status: Backport [https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-4.1.y&id=52f65e35c2b85908fa66cfc265be4e3fd88744a3]
+CVE: CVE-2017-16643
+
+Reported-by: Andrey Konovalov <andreyknvl@google.com>
+Reviewed-by: Andrey Konovalov <andreyknvl@google.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Adrian Stratulat <adrian.stratulat@enea.com>
+---
+ drivers/input/tablet/gtco.c | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/input/tablet/gtco.c b/drivers/input/tablet/gtco.c
+index abf09ac42ce4..339a0e2d2f86 100644
+--- a/drivers/input/tablet/gtco.c
++++ b/drivers/input/tablet/gtco.c
+@@ -231,13 +231,17 @@ static void parse_hid_report_descriptor(struct gtco *device, char * report,
+ 
+        /* Walk  this report and pull out the info we need */
+        while (i < length) {
+-               prefix = report[i];
+-
+-               /* Skip over prefix */
+-               i++;
++               prefix = report[i++];
+ 
+                /* Determine data size and save the data in the proper variable */
+-               size = PREF_SIZE(prefix);
++               size = (1U << PREF_SIZE(prefix)) >> 1;
++               if (i + size > length) {
++                       dev_err(ddev,
++                               "Not enough data (need %d, have %d)\n",
++                               i + size, length);
++                       break;
++               }
++
+                switch (size) {
+                case 1:
+                        data = report[i];
+@@ -245,8 +249,7 @@ static void parse_hid_report_descriptor(struct gtco *device, char * report,
+                case 2:
+                        data16 = get_unaligned_le16(&report[i]);
+                        break;
+-               case 3:
+-                       size = 4;
++               case 4:
+                        data32 = get_unaligned_le32(&report[i]);
+                        break;
+                }
+-- 
+cgit 1.2-0.3.lf.el7
+