DrathOrg/libratbag-plus
1
0
Fork 0
forked from drath/libratbag
Code Pull Requests Activity

hidpp20: prevent invalid ROM access

Browse Source 
The device can report how much rom it has through profile_count_oob.
Make sure we have something in ROM before accessing it.

Signed-off-by: Benjamin Tissoires <benjamin.tissoires@gmail.com>
This commit is contained in:
Benjamin Tissoires
2016-05-09 20:08:18 +02:00
parent c14a0ca2a1
commit fc07672983
2 changed files with 18 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
src/hidpp20.c
View File

@@ -1283,6 +1283,7 @@ hidpp20_onboard_profiles_initialize(struct hidpp20_device *device,
info->profile_count * sizeof(struct hidpp20_profile));
profiles->num_profiles = info->profile_count;
profiles->num_rom_profiles = info->profile_count_oob;
profiles->num_buttons = msg.msg.parameters[5] <= 16 ? msg.msg.parameters[5] : 16;
profiles->num_modes = HIDPP20_DPI_COUNT;
profiles->has_g_shift = (info->mechanical_layout & 0x03) == 2;
@@ -1532,7 +1533,8 @@ hidpp20_onboard_profiles_destroy(struct hidpp20_device *device,
static int
hidpp20_onboard_profiles_find_and_read_profile(struct hidpp20_device *device,
unsigned int index,
uint8_t *data)
uint8_t *data,
unsigned int num_rom_profiles)
{
int rc;
unsigned i;
@@ -1565,6 +1567,12 @@ hidpp20_onboard_profiles_find_and_read_profile(struct hidpp20_device *device,
}
/* something went wrong, the mouse is using the factory profile in ROM */
if (num_rom_profiles == 0)
return -EINVAL;
if (index >= num_rom_profiles)
index = num_rom_profiles - 1;
for (i = 0; i < HIDPP20_PROFILE_SIZE / 0x10; i++) {
rc = hidpp20_onboard_profiles_read_memory(device,
1,
@@ -1760,7 +1768,10 @@ int hidpp20_onboard_profiles_read(struct hidpp20_device *device,
if (index >= profiles_list->num_profiles)
return -EINVAL;
rc = hidpp20_onboard_profiles_find_and_read_profile(device, index, data);
rc = hidpp20_onboard_profiles_find_and_read_profile(device,
index,
data,
profiles_list->num_rom_profiles);
if (rc != 0)
return rc;
@@ -1802,7 +1813,10 @@ int hidpp20_onboard_profiles_write(struct hidpp20_device *device,
if (index >= profiles_list->num_profiles)
return -EINVAL;
rc = hidpp20_onboard_profiles_find_and_read_profile(device, index, data);
rc = hidpp20_onboard_profiles_find_and_read_profile(device,
index,
data,
profiles_list->num_rom_profiles);
if (rc < 0)
return rc;

1
src/hidpp20.h
View File

@@ -362,6 +362,7 @@ struct hidpp20_profile {
struct hidpp20_profiles {
uint8_t num_profiles;
uint8_t num_rom_profiles;
uint8_t num_buttons;
uint8_t num_modes;
uint8_t has_g_shift;