linux-kernel - Re: [PATCH 3/4] HID: multitouch: drop reports containing invalid values

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 9 Aug 2018 17:27:47 -1000
From:   Joey Pabalinas <joeypabalinas@...il.com>
To:     Benjamin Tissoires <benjamin.tissoires@...hat.com>
Cc:     Joey Pabalinas <joeypabalinas@...il.com>,
        "open list:HID CORE LAYER" <linux-input@...r.kernel.org>,
        lkml <linux-kernel@...r.kernel.org>,
        Jiri Kosina <jikos@...nel.org>,
        Daniel Martin <consume.noise@...il.com>
Subject: Re: [PATCH 3/4] HID: multitouch: drop reports containing invalid
 values

On Tue, Jul 03, 2018 at 10:13:54AM +0200, Benjamin Tissoires wrote:
> Hi Joey,
> You can't really use plain values like that. There is a tiny chance
> these values are valid on an other device.
> IIRC, MS spec says that we should ignore out of band values if they
> are tagged as such. Such input are tagged with NULL values
> (http://www.usb.org/developers/hidpage/HID1_11.pdf page 31) and MS
> spec mentioned this.
> 
> All in all, if you have this bit set, you need to compare the value
> with the logical_max/min for each field.
> 
> I never encountered a device that required this, so you are probably
> the lucky one :)

Ah, you are completely right. After giving that pdf a read over
I will definitely be dropping this patch from the v2.

-- 
Cheers,
Joey Pabalinas

Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)