libevdev: Clamp slot_count to MAX_SLOT_COUNT in MTB_Init

A malicious HID device advertising more than 64 contact slots can
cause an out-of-bounds stack read in MT_Slot_Sync because the loop
bounds were dictated by the unclamped device limits while iterating
over a fixed-size stack buffer.

Clamp evstate->slot_count to MAX_SLOT_COUNT during initialization
to prevent OOB stack access.

BUG=b:524107665
TEST=Built and verified using the project fortify ASAN PoC.

Change-Id: I03881b67469dbdd12cf57c33e41bf8ce87fce372
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/libevdev/+/8124614
Tested-by: Ranjan Kumar (xWF) <kumarranja@google.com>
Reviewed-by: Henry Barnor <hbarnor@chromium.org>
Reviewed-by: Jingyuan Liang <jingyliang@chromium.org>
Reviewed-by: Sean O'Brien <seobrien@chromium.org>
Commit-Queue: Ranjan Kumar (xWF) <kumarranja@google.com>
1 file changed