HID: picolcd_core: validate output report details
HID: picolcd_core: validate output report details

commit 1e87a2456b0227ca4ab881e19a11bb99d164e792 upstream.

A HID device could send a malicious output report that would cause the
picolcd HID driver to trigger a NULL dereference during attr file writing.

[ed58f755cc8caaf10c3e8c731a8b86fb8f13d6cb@suse.cz: changed

	report->maxfield < 1

to

	report->maxfield != 1

as suggested by Bruno].

CVE-2013-2899

Signed-off-by: Kees Cook <50cb10d2be062154b17ab4d66a4eab34f1cf1c84@chromium.org>
Reviewed-by: Bruno Prémont <07d37993a092409e6c5d6be7073d31d94250624b@linux-vserver.org>
Acked-by: Bruno Prémont <07d37993a092409e6c5d6be7073d31d94250624b@linux-vserver.org>
Signed-off-by: Jiri Kosina <ed58f755cc8caaf10c3e8c731a8b86fb8f13d6cb@suse.cz>
Signed-off-by: Greg Kroah-Hartman <4645f7897fd33786a2ee1264d590b3c400559d85@linuxfoundation.org>


TeamVee-Kanas/android_kernel_samsung_kanas,TeamVee-Kanas/android_kernel_samsung_kanas,TeamVee-Kanas/android_kernel_samsung_kanas,TeamVee-Kanas/android_kernel_samsung_kanas,TeamVee-Kanas/android_kernel_samsung_kanas