diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2014-08-27 09:38:06 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2014-08-27 09:38:06 -0700 |
| commit | ff0c57ac70434bc936cb0110eaf033a0a1a62e52 (patch) | |
| tree | 8a055fa5690a01b35ab7294e699114821a5f671c /drivers/hid/hid-picolcd_core.c | |
| parent | 1fb00cbca05ba13f386e75aa1f6d801895cfed29 (diff) | |
| parent | 844817e47eef14141cf59b8d5ac08dd11c0a9189 (diff) | |
| download | op-kernel-dev-ff0c57ac70434bc936cb0110eaf033a0a1a62e52.zip op-kernel-dev-ff0c57ac70434bc936cb0110eaf033a0a1a62e52.tar.gz | |
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid
Pull HID fixes from Jiri Kosina:
- fixes for potential memory corruption problems in magicmouse and
picolcd drivers (the HW would have to be manufactured to be
deliberately evil to trigger those) which were found by Steven
Vittitoe
- fix for false error message appearing in dmesg from logitech-dj
driver, from Benjamin Tissoires
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid:
HID: picolcd: sanity check report size in raw_event() callback
HID: magicmouse: sanity check report size in raw_event() callback
HID: logitech-dj: prevent false errors to be shown
Diffstat (limited to 'drivers/hid/hid-picolcd_core.c')
| -rw-r--r-- | drivers/hid/hid-picolcd_core.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/hid/hid-picolcd_core.c b/drivers/hid/hid-picolcd_core.c index acbb0210..020df3c 100644 --- a/drivers/hid/hid-picolcd_core.c +++ b/drivers/hid/hid-picolcd_core.c @@ -350,6 +350,12 @@ static int picolcd_raw_event(struct hid_device *hdev, if (!data) return 1; + if (size > 64) { + hid_warn(hdev, "invalid size value (%d) for picolcd raw event\n", + size); + return 0; + } + if (report->id == REPORT_KEY_STATE) { if (data->input_keys) ret = picolcd_raw_keypad(data, report, raw_data+1, size-1); |
