diff options
Diffstat (limited to 'drivers/hid/hid-magicmouse.c')
| -rw-r--r-- | drivers/hid/hid-magicmouse.c | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/drivers/hid/hid-magicmouse.c b/drivers/hid/hid-magicmouse.c index ecc2cbf300cc..29a74c1efcb8 100644 --- a/drivers/hid/hid-magicmouse.c +++ b/drivers/hid/hid-magicmouse.c | |||
| @@ -290,6 +290,11 @@ static int magicmouse_raw_event(struct hid_device *hdev, | |||
| 290 | if (size < 4 || ((size - 4) % 9) != 0) | 290 | if (size < 4 || ((size - 4) % 9) != 0) |
| 291 | return 0; | 291 | return 0; |
| 292 | npoints = (size - 4) / 9; | 292 | npoints = (size - 4) / 9; |
| 293 | if (npoints > 15) { | ||
| 294 | hid_warn(hdev, "invalid size value (%d) for TRACKPAD_REPORT_ID\n", | ||
| 295 | size); | ||
| 296 | return 0; | ||
| 297 | } | ||
| 293 | msc->ntouches = 0; | 298 | msc->ntouches = 0; |
| 294 | for (ii = 0; ii < npoints; ii++) | 299 | for (ii = 0; ii < npoints; ii++) |
| 295 | magicmouse_emit_touch(msc, ii, data + ii * 9 + 4); | 300 | magicmouse_emit_touch(msc, ii, data + ii * 9 + 4); |
| @@ -307,6 +312,11 @@ static int magicmouse_raw_event(struct hid_device *hdev, | |||
| 307 | if (size < 6 || ((size - 6) % 8) != 0) | 312 | if (size < 6 || ((size - 6) % 8) != 0) |
| 308 | return 0; | 313 | return 0; |
| 309 | npoints = (size - 6) / 8; | 314 | npoints = (size - 6) / 8; |
| 315 | if (npoints > 15) { | ||
| 316 | hid_warn(hdev, "invalid size value (%d) for MOUSE_REPORT_ID\n", | ||
| 317 | size); | ||
| 318 | return 0; | ||
| 319 | } | ||
| 310 | msc->ntouches = 0; | 320 | msc->ntouches = 0; |
| 311 | for (ii = 0; ii < npoints; ii++) | 321 | for (ii = 0; ii < npoints; ii++) |
| 312 | magicmouse_emit_touch(msc, ii, data + ii * 8 + 6); | 322 | magicmouse_emit_touch(msc, ii, data + ii * 8 + 6); |