projects / wrapfs-3.14.y.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 0bfb000) | patch
HID: magicmouse: sanity check report size in raw_event() callback
authorJiri Kosina <jkosina@suse.cz>
Wed, 27 Aug 2014 07:12:24 +0000 (09:12 +0200)
committerZefan Li <lizefan@huawei.com>
Thu, 25 Sep 2014 03:49:15 +0000 (11:49 +0800)
commite115f02bda5dc98fc31cec1fe6160bcee887789c
tree127d4fbbebace1a0be01a23aa7d620a4664cb314tree | snapshot
parent0bfb000447ffec4e7245c9c761fd0770acba504dcommit | diff
HID: magicmouse: sanity check report size in raw_event() callback

commit c54def7bd64d7c0b6993336abcffb8444795bf38 upstream.

The report passed to us from transport driver could potentially be
arbitrarily large, therefore we better sanity-check it so that
magicmouse_emit_touch() gets only valid values of raw_id.

Reported-by: Steven Vittitoe <scvitti@google.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Zefan Li <lizefan@huawei.com>
drivers/hid/hid-magicmouse.c diff | blob | history
wrapfs-3.14.y