Re: [PATCH 1/3] Don't copy more than 'count' byte
From: Benjamin Tissoires <hidden>
Date: 2014-08-26 21:23:46
On Sat, Aug 23, 2014 at 8:40 AM, Goffredo Baroncelli [off-list ref] wrote:
Don't copy more than 'count' byte, because *buf may be shorter than DJREPORT_SHORT_LENGTH,and this means an access violation. Of course count cannot be greather than the result buffer.
That's a really good catch, but one week late :) See https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=51217e69697fba92a06e07e16f55c9a52d8e8945 Cheers, Benjamin
quoted hunk ↗ jump to hunk
Signed-off-by: Goffredo Baroncelli <redacted> --- drivers/hid/hid-logitech-dj.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c index 486dbde..ca0ab51 100644 --- a/drivers/hid/hid-logitech-dj.c +++ b/drivers/hid/hid-logitech-dj.c@@ -557,7 +557,7 @@ static int logi_dj_ll_raw_request(struct hid_device *hid, if (!out_buf) return -ENOMEM; - if (count < DJREPORT_SHORT_LENGTH - 2) + if (count > DJREPORT_SHORT_LENGTH - 2) count = DJREPORT_SHORT_LENGTH - 2; out_buf[0] = REPORT_ID_DJ_SHORT; --1.9.3 -- To unsubscribe from this list: send the line "unsubscribe linux-input" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html