diff options
| author | Adrian Salido <[email protected]> | 2017-09-08 10:55:27 -0700 |
|---|---|---|
| committer | Jiri Kosina <[email protected]> | 2017-09-13 18:16:40 +0200 |
| commit | 8320caeeffdefec3b58b9d4a7ed8e1079492fe7b (patch) | |
| tree | db912024c509ba7ecad44eae01393f9c99c2d4d8 /net/lapb/lapb_timer.c | |
| parent | cac72b990d34f4c70208998a86f910ba38253c94 (diff) | |
HID: i2c-hid: allocate hid buffers for real worst case
The buffer allocation is not currently accounting for an extra byte for
the report id. This can cause an out of bounds access in function
i2c_hid_set_or_send_report() with reportID > 15.
Cc: [email protected]
Signed-off-by: Adrian Salido <[email protected]>
Reviewed-by: Benson Leung <[email protected]>
Signed-off-by: Guenter Roeck <[email protected]>
Signed-off-by: Dmitry Torokhov <[email protected]>
Signed-off-by: Jiri Kosina <[email protected]>
Diffstat (limited to 'net/lapb/lapb_timer.c')
0 files changed, 0 insertions, 0 deletions