aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/usb
diff options
context:
space:
mode:
authorAdam Kropelin <akropel1@rochester.rr.com>2005-12-13 20:03:39 -0500
committerLinus Torvalds <torvalds@g5.osdl.org>2005-12-14 00:18:16 -0500
commitcd6104572bca9e4afe0dcdb8ecd65ef90b01297b (patch)
treecca09c779e83341507b21c132b3ffe090110602e /drivers/usb
parentfb79ffa4ddbe3f6f30fdb8429b5bad84d25ae6ef (diff)
[PATCH] hid-core: Zero-pad truncated reports
When it detects a truncated report, hid-core emits a warning and then processes the report as usual. This is good because it allows buggy devices to still get data thru to userspace. However, the missing bytes of the report should be cleared before processing, otherwise userspace will be handed partially-uninitialized data. This fixes Debian tracker bug #330487. Signed-off-by: Adam Kropelin <akropel1@rochester.rr.com> Cc: Vojtech Pavlik <vojtech@suse.cz> Acked-by: Dmitry Torokhov <dtor_core@ameritech.net> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'drivers/usb')
-rw-r--r--drivers/usb/input/hid-core.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/usb/input/hid-core.c b/drivers/usb/input/hid-core.c
index 45f3130fadea..a3e44ef1df43 100644
--- a/drivers/usb/input/hid-core.c
+++ b/drivers/usb/input/hid-core.c
@@ -893,8 +893,10 @@ static int hid_input_report(int type, struct urb *urb, int interrupt, struct pt_
893 893
894 size = ((report->size - 1) >> 3) + 1; 894 size = ((report->size - 1) >> 3) + 1;
895 895
896 if (len < size) 896 if (len < size) {
897 dbg("report %d is too short, (%d < %d)", report->id, len, size); 897 dbg("report %d is too short, (%d < %d)", report->id, len, size);
898 memset(data + len, 0, size - len);
899 }
898 900
899 if (hid->claimed & HID_CLAIMED_HIDDEV) 901 if (hid->claimed & HID_CLAIMED_HIDDEV)
900 hiddev_report_event(hid, report); 902 hiddev_report_event(hid, report);