HID: fix a couple of off-by-ones

There are a few very theoretical off-by-one bugs in report descriptor size
checking when performing a pre-parsing fixup. Fix those.

Cc: stable@vger.kernel.org
Reported-by: Ben Hawkes <hawkes@google.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

1 files changed, 2 insertions, 2 deletions

diff --git a/drivers/hid/hid-lg.c b/drivers/hid/hid-lg.c
index a976f48263f6..f91ff145db9a 100644
--- a/drivers/hid/hid-lg.c
+++ b/drivers/hid/hid-lg.c
@@ -345,14 +345,14 @@ static __u8 *lg_report_fixup(struct hid_device *hdev, __u8 *rdesc,
         struct usb_device_descriptor *udesc;
         __u16 bcdDevice, rev_maj, rev_min;
 
-        if ((drv_data->quirks & LG_RDESC) && *rsize >= 90 && rdesc[83] == 0x26 &&
+        if ((drv_data->quirks & LG_RDESC) && *rsize >= 91 && rdesc[83] == 0x26 &&
                         rdesc[84] == 0x8c && rdesc[85] == 0x02) {
                 hid_info(hdev,
                          "fixing up Logitech keyboard report descriptor\n");
                 rdesc[84] = rdesc[89] = 0x4d;
                 rdesc[85] = rdesc[90] = 0x10;
         }
-        if ((drv_data->quirks & LG_RDESC_REL_ABS) && *rsize >= 50 &&
+        if ((drv_data->quirks & LG_RDESC_REL_ABS) && *rsize >= 51 &&
                         rdesc[32] == 0x81 && rdesc[33] == 0x06 &&
                         rdesc[49] == 0x81 && rdesc[50] == 0x06) {
                 hid_info(hdev,