dect
/
linux-2.6
Archived
13
0
Fork 0
Code Releases Activity

HID: i2c-hid: fix ret_count check 

ret_count has to be at least 3, as we have to count the 2 bytes that are used
for the size of the reply. Without this, memcpy() might be called with zero or
negative count.

Reported-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
This commit is contained in:
Jiri Kosina 2012-12-06 10:59:28 +01:00
parent e5b50fe7be
commit 9afd09a1db
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/hid/i2c-hid/i2c-hid.c
View File

@ -520,7 +520,7 @@ static int i2c_hid_get_raw_report(struct hid_device *hid,
ret_count = ihid->inbuf[0] | (ihid->inbuf[1] << 8);
if (!ret_count)
if (ret_count <= 2)
return 0;
ret_count = min(ret_count, ask_count);