summaryrefslogtreecommitdiff
path: root/drivers/hid/hid-sunplus.c
diff options
context:
space:
mode:
authorJiri Kosina <jkosina@suse.cz>2014-08-21 09:57:48 -0500
committerJiri Kosina <jkosina@suse.cz>2014-08-21 10:43:28 -0500
commit4ab25786c87eb20857bbb715c3ae34ec8fd6a214 (patch)
treea1f0b37bd3f77e369398df733e76c222f0a8f86d /drivers/hid/hid-sunplus.c
parentad3e14d7c5268c2e24477c6ef54bbdf88add5d36 (diff)
HID: fix a couple of off-by-ones
There are a few very theoretical off-by-one bugs in report descriptor size checking when performing a pre-parsing fixup. Fix those. Cc: stable@vger.kernel.org Reported-by: Ben Hawkes <hawkes@google.com> Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Diffstat (limited to 'drivers/hid/hid-sunplus.c')
-rw-r--r--drivers/hid/hid-sunplus.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/hid/hid-sunplus.c b/drivers/hid/hid-sunplus.c
index 87fc91e1c8de..91072fa54663 100644
--- a/drivers/hid/hid-sunplus.c
+++ b/drivers/hid/hid-sunplus.c
@@ -24,7 +24,7 @@
static __u8 *sp_report_fixup(struct hid_device *hdev, __u8 *rdesc,
unsigned int *rsize)
{
- if (*rsize >= 107 && rdesc[104] == 0x26 && rdesc[105] == 0x80 &&
+ if (*rsize >= 112 && rdesc[104] == 0x26 && rdesc[105] == 0x80 &&
rdesc[106] == 0x03) {
hid_info(hdev, "fixing up Sunplus Wireless Desktop report descriptor\n");
rdesc[105] = rdesc[110] = 0x03;