Skip to content

Commit

Permalink
HID: fix a crash in hid_report_raw_event() function.
Browse files Browse the repository at this point in the history
I'm using a Data Modul EasyTouch USB multitouch controller,
which is issuing a hid report with a size equals to 0. The rsize
value gets set to 536870912 and Linux is crashing in the memset
because the value is too big.

Signed-off-by: Armando Visconti <armando.visconti@st.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
  • Loading branch information
Armando Visconti authored and Jiri Kosina committed May 20, 2011
1 parent fdc6807 commit 966922f
Showing 1 changed file with 3 additions and 0 deletions.
3 changes: 3 additions & 0 deletions drivers/hid/hid-core.c
Original file line number Diff line number Diff line change
Expand Up @@ -1045,6 +1045,9 @@ void hid_report_raw_event(struct hid_device *hid, int type, u8 *data, int size,

rsize = ((report->size - 1) >> 3) + 1;

if (rsize > HID_MAX_BUFFER_SIZE)
rsize = HID_MAX_BUFFER_SIZE;

if (csize < rsize) {
dbg_hid("report %d is too short, (%d < %d)\n", report->id,
csize, rsize);
Expand Down

0 comments on commit 966922f

Please sign in to comment.