diff options
| author | Jiale Yao <yaojiale02@163.com> | 2026-09-24 22:44:07 +0800 |
|---|---|---|
| committer | Jiri Kosina <jkosina@suse.com> | 2026-10-16 11:36:46 +0200 |
| commit | 1cb92fcb2ac344d78737e3c5cb7b061dfb2850b1 (patch) | |
| tree | 011ecefff36966367e0b1da07e3a08d24784aaa2 /tools/perf/scripts/python | |
| parent | fc54e71a063c0dcc4bceba6d0f71805a9b84082d (diff) | |
HID: elo: reject short touchscreen reports
The HID core invokes raw_event callbacks before validating the report
length. elo_raw_event() only checks the first-byte packet marker before
elo_process_data() reads coordinates, flags, and pressure through offset
seven. A truncated packet beginning with the expected marker can therefore
cause an out-of-bounds read.
Require the complete eight-byte SmartSet packet before parsing it.
Commit 47669bec44fe ("HID: asus: refactor the two workqueues and init
sequence") added the same kind of raw_event length validation to hid-asus.
Fixes: d23efc19478a ("HID: add driver for ELO 4000/4500")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Diffstat (limited to 'tools/perf/scripts/python')
0 files changed, 0 insertions, 0 deletions