Merge "hid: usbhid: Changes to prevent buffer overflow" (3c418b44) · Commits · e / devices / android_kernel_xiaomi_markw

drivers/hid/usbhid/hiddev.c

+10 −9

Original line number	Diff line number	Diff line
		@@ -510,6 +510,7 @@ static noinline int hiddev_ioctl_usage(struct hiddev *hiddev, unsigned int cmd,
		goto inval;

		field = report->field[uref->field_index];
		}

		if (cmd == HIDIOCGCOLLECTIONINDEX) {
		if (uref->usage_index >= field->maxusage)
		@@ -519,9 +520,9 @@ static noinline int hiddev_ioctl_usage(struct hiddev *hiddev, unsigned int cmd,

		else if ((cmd == HIDIOCGUSAGES \|\| cmd == HIDIOCSUSAGES) &&
		(uref_multi->num_values > HID_MAX_MULTI_USAGES \|\|
		uref->usage_index + uref_multi->num_values > field->report_count))
		uref->usage_index + uref_multi->num_values >
		field->report_count))
		goto inval;
		}

		switch (cmd) {
		case HIDIOCGUSAGE: