aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/hid/i2c-hid
diff options
context:
space:
mode:
authorJiri Kosina <jkosina@suse.cz>2012-12-06 04:59:28 -0500
committerJiri Kosina <jkosina@suse.cz>2012-12-06 04:59:28 -0500
commit9afd09a1db93cc9084846c2b9bc0d1194743e5dc (patch)
tree9ba2f25c20b765b0e47ea824534e8a29ee1a4c6f /drivers/hid/i2c-hid
parente5b50fe7bea43d0658773c89ba410ecc56867ee6 (diff)
HID: i2c-hid: fix ret_count check
ret_count has to be at least 3, as we have to count the 2 bytes that are used for the size of the reply. Without this, memcpy() might be called with zero or negative count. Reported-by: Jean Delvare <khali@linux-fr.org> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Diffstat (limited to 'drivers/hid/i2c-hid')
-rw-r--r--drivers/hid/i2c-hid/i2c-hid.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c
index ce01d5916184..6e1774c3a3f9 100644
--- a/drivers/hid/i2c-hid/i2c-hid.c
+++ b/drivers/hid/i2c-hid/i2c-hid.c
@@ -520,7 +520,7 @@ static int i2c_hid_get_raw_report(struct hid_device *hid,
520 520
521 ret_count = ihid->inbuf[0] | (ihid->inbuf[1] << 8); 521 ret_count = ihid->inbuf[0] | (ihid->inbuf[1] << 8);
522 522
523 if (!ret_count) 523 if (ret_count <= 2)
524 return 0; 524 return 0;
525 525
526 ret_count = min(ret_count, ask_count); 526 ret_count = min(ret_count, ask_count);