git.openpandora.org
/
pandora-kernel.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
RDMA/ucma: Ensure that CM_ID exists prior to access it
[pandora-kernel.git]
/
drivers
/
hid
/
hid-picolcd.c
diff --git
a/drivers/hid/hid-picolcd.c
b/drivers/hid/hid-picolcd.c
index
01e7d2c
..
c952131
100644
(file)
--- a/
drivers/hid/hid-picolcd.c
+++ b/
drivers/hid/hid-picolcd.c
@@
-1424,7
+1424,7
@@
static ssize_t picolcd_operation_mode_store(struct device *dev,
buf += 10;
cnt -= 10;
}
buf += 10;
cnt -= 10;
}
- if (!report)
+ if (!report
|| report->maxfield != 1
)
return -EINVAL;
while (cnt > 0 && (buf[cnt-1] == '\n' || buf[cnt-1] == '\r'))
return -EINVAL;
while (cnt > 0 && (buf[cnt-1] == '\n' || buf[cnt-1] == '\r'))
@@
-2382,6
+2382,12
@@
static int picolcd_raw_event(struct hid_device *hdev,
if (!data)
return 1;
if (!data)
return 1;
+ if (size > 64) {
+ hid_warn(hdev, "invalid size value (%d) for picolcd raw event\n",
+ size);
+ return 0;
+ }
+
if (report->id == REPORT_KEY_STATE) {
if (data->input_keys)
ret = picolcd_raw_keypad(data, report, raw_data+1, size-1);
if (report->id == REPORT_KEY_STATE) {
if (data->input_keys)
ret = picolcd_raw_keypad(data, report, raw_data+1, size-1);