[PATCH 2/4] HID: corsair-void: fix out-of-bounds read in corsair_void_raw_event
From: Jiale Yao <hidden>
Date: 2026-07-14 13:16:33
Also in:
lkml
Subsystem:
hid core layer, the rest · Maintainers:
Jiri Kosina, Benjamin Tissoires, Linus Torvalds
Both the STATUS_REPORT and FIRMWARE_REPORT paths access data[4]. Add a size < 5 guard before the report dispatch. Assisted-by: Claude:deepseek-v4-pro Signed-off-by: Jiale Yao <redacted> --- drivers/hid/hid-corsair-void.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/drivers/hid/hid-corsair-void.c b/drivers/hid/hid-corsair-void.c
index 5e9a5b8f7f16..7c5435de6aae 100644
--- a/drivers/hid/hid-corsair-void.c
+++ b/drivers/hid/hid-corsair-void.c@@ -740,6 +740,8 @@ static int corsair_void_raw_event(struct hid_device *hid_dev, struct corsair_void_drvdata *drvdata = hid_get_drvdata(hid_dev); bool was_connected = drvdata->connected; + if (size < 5) + return 0; /* Description of packets are documented at the top of this file */ if (hid_report->id == CORSAIR_VOID_STATUS_REPORT_ID) { drvdata->mic_up = FIELD_GET(CORSAIR_VOID_MIC_MASK, data[2]);
--
2.34.1