mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-28 11:49:32 +00:00
HID: fix incorrent length condition in hidraw_write()
The bound check on the buffer length if (count > HID_MIN_BUFFER_SIZE) is of course incorrent, the proper check is if (count > HID_MAX_BUFFER_SIZE) Fix it. Reported-by: Jerry Ryle <jerry@mindtribe.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
This commit is contained in:
parent
d92870ddd2
commit
2b107d629d
1 changed files with 1 additions and 1 deletions
|
@ -113,7 +113,7 @@ static ssize_t hidraw_write(struct file *file, const char __user *buffer, size_t
|
||||||
if (!dev->hid_output_raw_report)
|
if (!dev->hid_output_raw_report)
|
||||||
return -ENODEV;
|
return -ENODEV;
|
||||||
|
|
||||||
if (count > HID_MIN_BUFFER_SIZE) {
|
if (count > HID_MAX_BUFFER_SIZE) {
|
||||||
printk(KERN_WARNING "hidraw: pid %d passed too large report\n",
|
printk(KERN_WARNING "hidraw: pid %d passed too large report\n",
|
||||||
task_pid_nr(current));
|
task_pid_nr(current));
|
||||||
return -EINVAL;
|
return -EINVAL;
|
||||||
|
|
Loading…
Reference in a new issue