]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
projects / thirdparty / kernel / stable.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 74efeda) | patch
HID: magicmouse: sanity check report size in raw_event() callback
authorJiri Kosina <jkosina@suse.cz>
Wed, 27 Aug 2014 07:12:24 +0000 (09:12 +0200)
committerBen Hutchings <ben@decadent.org.uk>
Sat, 13 Sep 2014 22:41:47 +0000 (23:41 +0100)
commite3ead9249d874dbb7a8e7c3e6e54de35a481986c
treed79ea6b6e63443b60d320936ab56b78ac5132818tree
parent74efedade8e97ae72326c42c4456a21b5c07e19bcommit | diff
HID: magicmouse: sanity check report size in raw_event() callback

commit c54def7bd64d7c0b6993336abcffb8444795bf38 upstream.

The report passed to us from transport driver could potentially be
arbitrarily large, therefore we better sanity-check it so that
magicmouse_emit_touch() gets only valid values of raw_id.

Reported-by: Steven Vittitoe <scvitti@google.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
drivers/hid/hid-magicmouse.c diff | blob | blame | history
Mirror https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git