Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit be19f93d authored by Linux Build Service Account's avatar Linux Build Service Account Committed by Gerrit - the friendly Code Review server
Browse files

Merge "HID: core: prevent out-of-bound readings"

parents ac08dcd0 f6aab228

drivers/hid/hid-core.c

+3 −0
Original line number Diff line number Diff line
@@ -1213,6 +1213,7 @@ static void hid_input_field(struct hid_device *hid, struct hid_field *field, 
		/* Ignore report if ErrorRollOver */

		if (!(field->flags & HID_MAIN_ITEM_VARIABLE) &&

		    value[n] >= min && value[n] <= max &&

		    value[n] - min < field->maxusage &&

		    field->usage[value[n] - min].hid == HID_UP_KEYBOARD + 1)

			goto exit;

	}
@@ -1225,11 +1226,13 @@ static void hid_input_field(struct hid_device *hid, struct hid_field *field, 
		}



		if (field->value[n] >= min && field->value[n] <= max

			&& field->value[n] - min < field->maxusage

			&& field->usage[field->value[n] - min].hid

			&& search(value, field->value[n], count))

				hid_process_event(hid, field, &field->usage[field->value[n] - min], 0, interrupt);



		if (value[n] >= min && value[n] <= max

			&& value[n] - min < field->maxusage

			&& field->usage[value[n] - min].hid

			&& search(field->value, value[n], count))

				hid_process_event(hid, field, &field->usage[value[n] - min], 1, interrupt);