diff mbox series

Input: gtco - fix uninitialized stack read

Message ID 20200815153426.435592-1-phollinsky@holtechnik.com
State New
Headers show
Series Input: gtco - fix uninitialized stack read | expand

Commit Message

Paul Hollinsky Aug. 15, 2020, 3:34 p.m. UTC
If a malformed HID report is sent from the device, a prefix with
TYPE_MAIN may read globtype before it is written with TYPE_GLOBAL.

The oldval array is protected from uninitialized read by the
indent counter.

Reported-by: syzbot+6a1bb5a33a0b128085bc@syzkaller.appspotmail.com
Signed-off-by: Paul Hollinsky <phollinsky@holtechnik.com>
---
 drivers/input/tablet/gtco.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/drivers/input/tablet/gtco.c b/drivers/input/tablet/gtco.c
index 44bb1f69b4b2..db030cd043d5 100644
--- a/drivers/input/tablet/gtco.c
+++ b/drivers/input/tablet/gtco.c
@@ -217,7 +217,7 @@  static void parse_hid_report_descriptor(struct gtco *device, char * report,
 	__u32 usage = 0;
 
 	/* Global Values, indexed by TAG */
-	__u32 globalval[TAG_GLOB_MAX];
+	__u32 globalval[TAG_GLOB_MAX] = { 0 };
 	__u32 oldval[TAG_GLOB_MAX];
 
 	/* Debug stuff */