HID: fix a couple of off-by-ones
authorJiri Kosina <jkosina@suse.cz>
Thu, 21 Aug 2014 14:57:48 +0000 (09:57 -0500)
committerWilly Tarreau <w@1wt.eu>
Fri, 18 Sep 2015 11:51:53 +0000 (13:51 +0200)
commitd8b3be1ede7a9559cef59f8066ba90a17f989dd8
treefdbc52a24d85f5bdf7cd99340099005e6ff28dc3
parentf9e6d14d33ab7e4ada2d59acaf16196626063e95
HID: fix a couple of off-by-ones

commit 4ab25786c87eb20857bbb715c3ae34ec8fd6a214 upstream.

There are a few very theoretical off-by-one bugs in report descriptor size
checking when performing a pre-parsing fixup. Fix those.

Reported-by: Ben Hawkes <hawkes@google.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
[bwh: Backported to 2.6.32:
 - Adjust context
 - Drop change to a quirk in hid-lg.c that doesn't exist here]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
CVE-2014-3184

Signed-off-by: Willy Tarreau <w@1wt.eu>
drivers/hid/hid-cherry.c
drivers/hid/hid-kye.c
drivers/hid/hid-lg.c
drivers/hid/hid-monterey.c
drivers/hid/hid-petalynx.c
drivers/hid/hid-sunplus.c