Commit 8b0774e3 authored by hal@realmsys.com's avatar hal@realmsys.com Committed by Vojtech Pavlik

input: Fix range checks for the HIDIOC[GS]USAGES ioctl() to allow

       reading full number of bytes.

From: Hal Tolley <hal@realmsys.com>
Signed-off-by: default avatarVojtech Pavlik <vojtech@suse.cz>
parent 3325d95e
......@@ -634,9 +634,8 @@ static int hiddev_ioctl(struct inode *inode, struct file *file, unsigned int cmd
goto inval;
else if ((cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) &&
(uref_multi->num_values >= HID_MAX_MULTI_USAGES ||
uref->usage_index + uref_multi->num_values >= field->report_count ||
uref->usage_index + uref_multi->num_values < uref->usage_index))
(uref_multi->num_values > HID_MAX_MULTI_USAGES ||
uref->usage_index + uref_multi->num_values >= field->report_count))
goto inval;
}
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment