On Tue, May 26, 2015 at 3:56 PM, Dan Carpenter <dan.carpen...@oracle.com> wrote: >> elt->length is a u8, so the upper bound is 255. > > Yes. I know that, but is 255 correct?
Eventually body->data is passed to oz_hcd_get_desc_cnf along with data_len. In there, body->data (now called desc) is memcpy'd into a URB transfer buffer. The checks to see if that transfer buffer is big enough are broken and vulnerable, and another patch in this set addresses that. But anyway, AFAIK, the 255 limit works fine for all subsequent types used, after this patch set is applied. The use of a u8 cannot, at this point, be *increased* since this protocol is tied to particular hardware chips sold by Atmel/Ozmo. And I can't see a reason why it should be further bounded either. _______________________________________________ devel mailing list de...@linuxdriverproject.org http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel
