diff options
| author |   Jiri Kosina <jkosina@suse.cz> | 2014-08-21 09:57:48 -0500 |
|---|---|---|
| committer | Jiri Kosina <jkosina@suse.cz> | 2014-08-21 10:43:28 -0500 |
| commit | 4ab25786c87eb20857bbb715c3ae34ec8fd6a214 (patch) | |
| tree | a1f0b37bd3f77e369398df733e76c222f0a8f86d /drivers/hid/hid-monterey.c | |
| parent | HID: logitech: perform bounds checking on device_id early enough (diff) | |
| download | linux-dev-4ab25786c87eb20857bbb715c3ae34ec8fd6a214.tar.xz linux-dev-4ab25786c87eb20857bbb715c3ae34ec8fd6a214.zip | |
HID: fix a couple of off-by-ones
There are a few very theoretical off-by-one bugs in report descriptor size
checking when performing a pre-parsing fixup. Fix those.
Cc: stable@vger.kernel.org
Reported-by: Ben Hawkes <hawkes@google.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Diffstat (limited to 'drivers/hid/hid-monterey.c')
| -rw-r--r-- | drivers/hid/hid-monterey.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/hid/hid-monterey.c b/drivers/hid/hid-monterey.c index 9e14c00eb1b6..25daf28b26bd 100644 --- a/drivers/hid/hid-monterey.c +++ b/drivers/hid/hid-monterey.c @@ -24,7 +24,7 @@ static __u8 *mr_report_fixup(struct hid_device *hdev, __u8 *rdesc, unsigned int *rsize) { - if (*rsize >= 30 && rdesc[29] == 0x05 && rdesc[30] == 0x09) { + if (*rsize >= 31 && rdesc[29] == 0x05 && rdesc[30] == 0x09) { hid_info(hdev, "fixing up button/consumer in HID report descriptor\n"); rdesc[30] = 0x0c; } |