[PATCH 1/4] HID: cougar: fix out-of-bounds read in cougar_raw_event

[Jiale Yao]

cougar_raw_event() accesses data[COUGAR_FIELD_CODE] and
data[COUGAR_FIELD_ACTION] (offsets 1 and 2) before validating
the report size.  A malformed HID report shorter than 3 bytes
would read past the allocated buffer.

Add a size < 3 check before accessing those fields.

Assisted-by: Claude:deepseek-v4-pro
Signed-off-by: Jiale Yao <yaojiale02@xxxxxxx>
---
 drivers/hid/hid-cougar.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/hid/hid-cougar.c b/drivers/hid/hid-cougar.c
index ad027c45f162..9927f45a795b 100644
--- a/drivers/hid/hid-cougar.c
+++ b/drivers/hid/hid-cougar.c
@@ -270,6 +270,12 @@ static int cougar_raw_event(struct hid_device *hdev, struct hid_report *report,
 	if (!shared->enabled || !shared->input)
 		return -EPERM;
 
+	if (size < 3) {
+		hid_err(hdev, "Received HID report of bad size (%d)",
+			size);
+		return -EPERM;
+	}
+
 	code = data[COUGAR_FIELD_CODE];
 	action = data[COUGAR_FIELD_ACTION];
 	for (i = 0; cougar_mapping[i][0]; i++) {
-- 
2.34.1