[PATCH] HID: oxp: reject short input reports

[Jiale Yao]

oxp_hid_raw_event() logs a full OXP packet and then dispatches it to one
of two parsers. Both parsers access fixed offsets and cast the input to
fixed-size report structures without checking the received length. A short
report can therefore be read beyond its valid data.

Reject reports shorter than the fixed OXP packet size before logging or
dispatching them.

Signed-off-by: Jiale Yao <yaojiale02@xxxxxxx>
---
 drivers/hid/hid-oxp.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/hid/hid-oxp.c b/drivers/hid/hid-oxp.c
index 1e691ebc1199..e1e1b99e9878 100644
--- a/drivers/hid/hid-oxp.c
+++ b/drivers/hid/hid-oxp.c
@@ -435,6 +435,9 @@ static int oxp_hid_raw_event(struct hid_device *hdev, struct hid_report *report,
 {
 	u16 up = get_usage_page(hdev);
 
+	if (size < OXP_PACKET_SIZE)
+		return 0;
+
 	dev_dbg(&hdev->dev, "raw event data: [%*ph]\n", OXP_PACKET_SIZE, data);
 
 	switch (up) {
-- 
2.34.1