diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2014-08-27 09:38:06 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2014-08-27 09:38:06 -0700 |
| commit | ff0c57ac70434bc936cb0110eaf033a0a1a62e52 (patch) | |
| tree | 8a055fa5690a01b35ab7294e699114821a5f671c /drivers/hid/hid-magicmouse.c | |
| parent | 1fb00cbca05ba13f386e75aa1f6d801895cfed29 (diff) | |
| parent | 844817e47eef14141cf59b8d5ac08dd11c0a9189 (diff) | |
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid
Pull HID fixes from Jiri Kosina:
- fixes for potential memory corruption problems in magicmouse and
picolcd drivers (the HW would have to be manufactured to be
deliberately evil to trigger those) which were found by Steven
Vittitoe
- fix for false error message appearing in dmesg from logitech-dj
driver, from Benjamin Tissoires
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid:
HID: picolcd: sanity check report size in raw_event() callback
HID: magicmouse: sanity check report size in raw_event() callback
HID: logitech-dj: prevent false errors to be shown
Diffstat (limited to 'drivers/hid/hid-magicmouse.c')
| -rw-r--r-- | drivers/hid/hid-magicmouse.c | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/drivers/hid/hid-magicmouse.c b/drivers/hid/hid-magicmouse.c index ecc2cbf300cc..29a74c1efcb8 100644 --- a/drivers/hid/hid-magicmouse.c +++ b/drivers/hid/hid-magicmouse.c @@ -290,6 +290,11 @@ static int magicmouse_raw_event(struct hid_device *hdev, if (size < 4 || ((size - 4) % 9) != 0) return 0; npoints = (size - 4) / 9; + if (npoints > 15) { + hid_warn(hdev, "invalid size value (%d) for TRACKPAD_REPORT_ID\n", + size); + return 0; + } msc->ntouches = 0; for (ii = 0; ii < npoints; ii++) magicmouse_emit_touch(msc, ii, data + ii * 9 + 4); @@ -307,6 +312,11 @@ static int magicmouse_raw_event(struct hid_device *hdev, if (size < 6 || ((size - 6) % 8) != 0) return 0; npoints = (size - 6) / 8; + if (npoints > 15) { + hid_warn(hdev, "invalid size value (%d) for MOUSE_REPORT_ID\n", + size); + return 0; + } msc->ntouches = 0; for (ii = 0; ii < npoints; ii++) magicmouse_emit_touch(msc, ii, data + ii * 8 + 6); |