git.openpandora.org
/
pandora-kernel.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
| inline |
side by side
HID: hid-cypress: validate length of report
[pandora-kernel.git]
/
drivers
/
hid
/
hid-cypress.c
diff --git
a/drivers/hid/hid-cypress.c
b/drivers/hid/hid-cypress.c
index
9e43aac
..
d6cae26
100644
(file)
--- a/
drivers/hid/hid-cypress.c
+++ b/
drivers/hid/hid-cypress.c
@@
-40,6
+40,9
@@
static __u8 *cp_report_fixup(struct hid_device *hdev, __u8 *rdesc,
if (!(quirks & CP_RDESC_SWAPPED_MIN_MAX))
return rdesc;
+ if (*rsize < 4)
+ return rdesc;
+
for (i = 0; i < *rsize - 4; i++)
if (rdesc[i] == 0x29 && rdesc[i + 2] == 0x19) {
__u8 tmp;