git.openpandora.org
/
pandora-kernel.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
Merge branch 'stable-3.2' into pandora-3.2
[pandora-kernel.git]
/
drivers
/
input
/
tablet
/
gtco.c
diff --git
a/drivers/input/tablet/gtco.c
b/drivers/input/tablet/gtco.c
index
929215a
..
ce26a82
100644
(file)
--- a/
drivers/input/tablet/gtco.c
+++ b/
drivers/input/tablet/gtco.c
@@
-232,13
+232,17
@@
static void parse_hid_report_descriptor(struct gtco *device, char * report,
/* Walk this report and pull out the info we need */
while (i < length) {
/* Walk this report and pull out the info we need */
while (i < length) {
- prefix = report[i];
-
- /* Skip over prefix */
- i++;
+ prefix = report[i++];
/* Determine data size and save the data in the proper variable */
/* Determine data size and save the data in the proper variable */
- size = PREF_SIZE(prefix);
+ size = (1U << PREF_SIZE(prefix)) >> 1;
+ if (i + size > length) {
+ dev_err(&device->usbdev->dev,
+ "Not enough data (need %d, have %d)\n",
+ i + size, length);
+ break;
+ }
+
switch (size) {
case 1:
data = report[i];
switch (size) {
case 1:
data = report[i];
@@
-246,8
+250,7
@@
static void parse_hid_report_descriptor(struct gtco *device, char * report,
case 2:
data16 = get_unaligned_le16(&report[i]);
break;
case 2:
data16 = get_unaligned_le16(&report[i]);
break;
- case 3:
- size = 4;
+ case 4:
data32 = get_unaligned_le32(&report[i]);
break;
}
data32 = get_unaligned_le32(&report[i]);
break;
}