Merge "Input: gtco - fix potential out-of-bound access" (635ab41e) · Commits · e / devices / android_kernel_xiaomi_markw

drivers/input/tablet/gtco.c

+10 −7

Original line number	Diff line number	Diff line
		@@ -231,13 +231,17 @@ static void parse_hid_report_descriptor(struct gtco device, char report,

		/* Walk this report and pull out the info we need */
		while (i < length) {
		prefix = report[i];

		/* Skip over prefix */
		i++;
		prefix = report[i++];

		/* Determine data size and save the data in the proper variable */
		size = PREF_SIZE(prefix);
		size = (1U << PREF_SIZE(prefix)) >> 1;
		if (i + size > length) {
		dev_err(ddev,
		"Not enough data (need %d, have %d)\n",
		i + size, length);
		break;
		}

		switch (size) {
		case 1:
		data = report[i];
		@@ -245,8 +249,7 @@ static void parse_hid_report_descriptor(struct gtco device, char report,
		case 2:
		data16 = get_unaligned_le16(&report[i]);
		break;
		case 3:
		size = 4;
		case 4:
		data32 = get_unaligned_le32(&report[i]);
		break;
		}