diff options
| author | Corey Minyard | 2017-11-02 17:19:15 +0100 |
|---|---|---|
| committer | Corey Minyard | 2017-11-02 17:19:15 +0100 |
| commit | 6297fabd93f93182245383ba7de56bef829a796b (patch) | |
| tree | 804f5d28ada61b402d56281c9a047308d26347f4 /drivers/hid/usbhid/hid-core.c | |
| parent | ipmi_si: Delete an error message for a failed memory allocation in try_smi_in... (diff) | |
| parent | module: Do not paper over type mismatches in module_param_call() (diff) | |
| download | kernel-qcow2-linux-6297fabd93f93182245383ba7de56bef829a796b.tar.gz kernel-qcow2-linux-6297fabd93f93182245383ba7de56bef829a796b.tar.xz kernel-qcow2-linux-6297fabd93f93182245383ba7de56bef829a796b.zip | |
Merge branch 'modules-next' of git://git.kernel.org/pub/scm/linux/kernel/git/jeyu/linux into for-next
The IPMI SI driver was split into different pieces, merge the module
tree to accountfor that.
Signed-off-by: Corey Minyard <cminyard@mvista.com>
Diffstat (limited to 'drivers/hid/usbhid/hid-core.c')
| -rw-r--r-- | drivers/hid/usbhid/hid-core.c | 12 |
1 files changed, 11 insertions, 1 deletions
diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c index 089bad8a9a21..045b5da9b992 100644 --- a/drivers/hid/usbhid/hid-core.c +++ b/drivers/hid/usbhid/hid-core.c @@ -975,6 +975,8 @@ static int usbhid_parse(struct hid_device *hid) unsigned int rsize = 0; char *rdesc; int ret, n; + int num_descriptors; + size_t offset = offsetof(struct hid_descriptor, desc); quirks = usbhid_lookup_quirk(le16_to_cpu(dev->descriptor.idVendor), le16_to_cpu(dev->descriptor.idProduct)); @@ -997,10 +999,18 @@ static int usbhid_parse(struct hid_device *hid) return -ENODEV; } + if (hdesc->bLength < sizeof(struct hid_descriptor)) { + dbg_hid("hid descriptor is too short\n"); + return -EINVAL; + } + hid->version = le16_to_cpu(hdesc->bcdHID); hid->country = hdesc->bCountryCode; - for (n = 0; n < hdesc->bNumDescriptors; n++) + num_descriptors = min_t(int, hdesc->bNumDescriptors, + (hdesc->bLength - offset) / sizeof(struct hid_class_descriptor)); + + for (n = 0; n < num_descriptors; n++) if (hdesc->desc[n].bDescriptorType == HID_DT_REPORT) rsize = le16_to_cpu(hdesc->desc[n].wDescriptorLength); |