From 9afd09a1db93cc9084846c2b9bc0d1194743e5dc Mon Sep 17 00:00:00 2001 From: Jiri Kosina Date: Thu, 6 Dec 2012 10:59:28 +0100 Subject: [PATCH] HID: i2c-hid: fix ret_count check ret_count has to be at least 3, as we have to count the 2 bytes that are used for the size of the reply. Without this, memcpy() might be called with zero or negative count. Reported-by: Jean Delvare Signed-off-by: Jiri Kosina --- drivers/hid/i2c-hid/i2c-hid.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c index ce01d591618..6e1774c3a3f 100644 --- a/drivers/hid/i2c-hid/i2c-hid.c +++ b/drivers/hid/i2c-hid/i2c-hid.c @@ -520,7 +520,7 @@ static int i2c_hid_get_raw_report(struct hid_device *hid, ret_count = ihid->inbuf[0] | (ihid->inbuf[1] << 8); - if (!ret_count) + if (ret_count <= 2) return 0; ret_count = min(ret_count, ask_count); -- 2.46.0