The driver can be crashed with devices that expose crafted
descriptors with too few endpoints.
See:
http://seclists.org/bugtraq/2016/Mar/61
Signed-off-by: Oliver Neukum <oneu...@suse.com>
---
drivers/usb/serial/digi_acceleport.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/usb/serial/digi_acceleport.c
b/drivers/usb/serial/digi_acceleport.c
index 12b0e67..c4d4d45 100644
--- a/drivers/usb/serial/digi_acceleport.c
+++ b/drivers/usb/serial/digi_acceleport.c
@@ -1260,6 +1260,11 @@ static int digi_startup(struct usb_serial *serial)
spin_lock_init(&serial_priv->ds_serial_lock);
serial_priv->ds_oob_port_num = serial->type->num_ports;
+ if (!(serial_priv->ds_oob_port_num == 2 && serial->type ==
&digi_acceleport_2_device)
+ && !(serial_priv->ds_oob_port_num == 4 && serial->type ==
&digi_acceleport_4_device)) {
+ kfree(serial_priv);
+ return -EINVAL;
+ }
serial_priv->ds_oob_port = serial->port[serial_priv->ds_oob_port_num];
ret = digi_port_init(serial_priv->ds_oob_port,
--
2.1.4
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
