From mboxrd@z Thu Jan  1 00:00:00 1970
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Subject: USB: core: prevent malicious bNumInterfaces overflow
From: Alan Stern <stern@rowland.harvard.edu>
Message-Id: <Pine.LNX.4.44L0.1712121423450.1358-100000@iolanthe.rowland.org>
Date: Tue, 12 Dec 2017 14:25:13 -0500 (EST)
To: Greg KH <greg@kroah.com>
Cc: Andrey Konovalov <andreyknvl@google.com>, USB list <linux-usb@vger.kernel.org>
List-ID: <linux-usb.vger.kernel.org>

QSBtYWxpY2lvdXMgVVNCIGRldmljZSB3aXRoIGNyYWZ0ZWQgZGVzY3JpcHRvcnMgY2FuIGNhdXNl
IHRoZSBrZXJuZWwKdG8gYWNjZXNzIHVuYWxsb2NhdGVkIG1lbW9yeSBieSBzZXR0aW5nIHRoZSBi
TnVtSW50ZXJmYWNlcyB2YWx1ZSB0b28KaGlnaCBpbiBhIGNvbmZpZ3VyYXRpb24gZGVzY3JpcHRv
ci4gIEFsdGhvdWdoIHRoZSB2YWx1ZSBpcyBhZGp1c3RlZApkdXJpbmcgcGFyc2luZywgdGhpcyBh
ZGp1c3RtZW50IGlzIHNraXBwZWQgaW4gb25lIG9mIHRoZSBlcnJvciByZXR1cm4KcGF0aHMuCgpU
aGlzIHBhdGNoIHByZXZlbnRzIHRoZSBwcm9ibGVtIGJ5IHNldHRpbmcgYk51bUludGVyZmFjZXMg
dG8gMAppbml0aWFsbHkuICBUaGUgZXhpc3RpbmcgY29kZSBhbHJlYWR5IHNldHMgaXQgdG8gdGhl
IHByb3BlciB2YWx1ZQphZnRlciBwYXJzaW5nIGlzIGNvbXBsZXRlLgoKU2lnbmVkLW9mZi1ieTog
QWxhbiBTdGVybiA8c3Rlcm5Acm93bGFuZC5oYXJ2YXJkLmVkdT4KUmVwb3J0ZWQtYnk6IEFuZHJl
eSBLb25vdmFsb3YgPGFuZHJleWtudmxAZ29vZ2xlLmNvbT4KQ0M6IDxzdGFibGVAdmdlci5rZXJu
ZWwub3JnPgotLS0KCgpbYXMxODU1XQoKCiBkcml2ZXJzL3VzYi9jb3JlL2NvbmZpZy5jIHwgICAg
NCArKystCiAxIGZpbGUgY2hhbmdlZCwgMyBpbnNlcnRpb25zKCspLCAxIGRlbGV0aW9uKC0pCgoK
LS0KVG8gdW5zdWJzY3JpYmUgZnJvbSB0aGlzIGxpc3Q6IHNlbmQgdGhlIGxpbmUgInVuc3Vic2Ny
aWJlIGxpbnV4LXVzYiIgaW4KdGhlIGJvZHkgb2YgYSBtZXNzYWdlIHRvIG1ham9yZG9tb0B2Z2Vy
Lmtlcm5lbC5vcmcKTW9yZSBtYWpvcmRvbW8gaW5mbyBhdCAgaHR0cDovL3ZnZXIua2VybmVsLm9y
Zy9tYWpvcmRvbW8taW5mby5odG1sCgpJbmRleDogdXNiLTQueC9kcml2ZXJzL3VzYi9jb3JlL2Nv
bmZpZy5jCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT0KLS0tIHVzYi00Lngub3JpZy9kcml2ZXJzL3VzYi9jb3JlL2NvbmZp
Zy5jCisrKyB1c2ItNC54L2RyaXZlcnMvdXNiL2NvcmUvY29uZmlnLmMKQEAgLTU1NSw2ICs1NTUs
OSBAQCBzdGF0aWMgaW50IHVzYl9wYXJzZV9jb25maWd1cmF0aW9uKHN0cnVjCiAJdW5zaWduZWQg
aWFkX251bSA9IDA7CiAKIAltZW1jcHkoJmNvbmZpZy0+ZGVzYywgYnVmZmVyLCBVU0JfRFRfQ09O
RklHX1NJWkUpOworCW5pbnRmID0gbmludGZfb3JpZyA9IGNvbmZpZy0+ZGVzYy5iTnVtSW50ZXJm
YWNlczsKKwljb25maWctPmRlc2MuYk51bUludGVyZmFjZXMgPSAwOwkvLyBBZGp1c3RlZCBsYXRl
cgorCiAJaWYgKGNvbmZpZy0+ZGVzYy5iRGVzY3JpcHRvclR5cGUgIT0gVVNCX0RUX0NPTkZJRyB8
fAogCSAgICBjb25maWctPmRlc2MuYkxlbmd0aCA8IFVTQl9EVF9DT05GSUdfU0laRSB8fAogCSAg
ICBjb25maWctPmRlc2MuYkxlbmd0aCA+IHNpemUpIHsKQEAgLTU2OCw3ICs1NzEsNiBAQCBzdGF0
aWMgaW50IHVzYl9wYXJzZV9jb25maWd1cmF0aW9uKHN0cnVjCiAJYnVmZmVyICs9IGNvbmZpZy0+
ZGVzYy5iTGVuZ3RoOwogCXNpemUgLT0gY29uZmlnLT5kZXNjLmJMZW5ndGg7CiAKLQluaW50ZiA9
IG5pbnRmX29yaWcgPSBjb25maWctPmRlc2MuYk51bUludGVyZmFjZXM7CiAJaWYgKG5pbnRmID4g
VVNCX01BWElOVEVSRkFDRVMpIHsKIAkJZGV2X3dhcm4oZGRldiwgImNvbmZpZyAlZCBoYXMgdG9v
IG1hbnkgaW50ZXJmYWNlczogJWQsICIKIAkJICAgICJ1c2luZyBtYXhpbXVtIGFsbG93ZWQ6ICVk
XG4iLAo=