HID: fix a couple of off-by-ones

There are a few very theoretical off-by-one bugs in report descriptor size
checking when performing a pre-parsing fixup. Fix those.

Cc: stable@vger.kernel.org
Reported-by: Ben Hawkes <hawkes@google.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

1 files changed, 1 insertions, 1 deletions

diff --git a/drivers/hid/hid-monterey.c b/drivers/hid/hid-monterey.c
index 9e14c00eb1b6..25daf28b26bd 100644
--- a/drivers/hid/hid-monterey.c
+++ b/drivers/hid/hid-monterey.c
@@ -24,7 +24,7 @@
 static __u8 *mr_report_fixup(struct hid_device *hdev, __u8 *rdesc,
                 unsigned int *rsize)
 {
-        if (*rsize >= 30 && rdesc[29] == 0x05 && rdesc[30] == 0x09) {
+        if (*rsize >= 31 && rdesc[29] == 0x05 && rdesc[30] == 0x09) {
                 hid_info(hdev, "fixing up button/consumer in HID report descriptor\n");
                 rdesc[30] = 0x0c;
         }