diff options
| author | Ingo Molnar <mingo@kernel.org> | 2017-11-07 10:48:05 +0100 |
|---|---|---|
| committer | Ingo Molnar <mingo@kernel.org> | 2017-11-07 10:48:05 +0100 |
| commit | 783711f0d2458ca1bd716000e767c478cef27144 (patch) | |
| tree | 0aebe2cfc09cbfa9a18e6a5e8d002489745f45a8 /drivers/input/tablet | |
| parent | objtool: Print top level commands on incorrect usage (diff) | |
| parent | Merge branch 'for-4.14-fixes' of git://git.kernel.org/pub/scm/linux/kernel/gi... (diff) | |
| download | linux-783711f0d2458ca1bd716000e767c478cef27144.tar.xz linux-783711f0d2458ca1bd716000e767c478cef27144.zip | |
Merge branch 'linus' into core/objtool, to pick up dependent fixes
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Diffstat (limited to 'drivers/input/tablet')
| -rw-r--r-- | drivers/input/tablet/Makefile | 1 | ||||
| -rw-r--r-- | drivers/input/tablet/gtco.c | 17 |
2 files changed, 11 insertions, 7 deletions
diff --git a/drivers/input/tablet/Makefile b/drivers/input/tablet/Makefile index 200fc4e11987..8279ccc18b0a 100644 --- a/drivers/input/tablet/Makefile +++ b/drivers/input/tablet/Makefile @@ -1,3 +1,4 @@ +# SPDX-License-Identifier: GPL-2.0 # # Makefile for the tablet drivers # diff --git a/drivers/input/tablet/gtco.c b/drivers/input/tablet/gtco.c index b796e891e2ee..4b8b9d7aa75e 100644 --- a/drivers/input/tablet/gtco.c +++ b/drivers/input/tablet/gtco.c @@ -230,13 +230,17 @@ static void parse_hid_report_descriptor(struct gtco *device, char * report, /* Walk this report and pull out the info we need */ while (i < length) { - prefix = report[i]; - - /* Skip over prefix */ - i++; + prefix = report[i++]; /* Determine data size and save the data in the proper variable */ - size = PREF_SIZE(prefix); + size = (1U << PREF_SIZE(prefix)) >> 1; + if (i + size > length) { + dev_err(ddev, + "Not enough data (need %d, have %d)\n", + i + size, length); + break; + } + switch (size) { case 1: data = report[i]; @@ -244,8 +248,7 @@ static void parse_hid_report_descriptor(struct gtco *device, char * report, case 2: data16 = get_unaligned_le16(&report[i]); break; - case 3: - size = 4; + case 4: data32 = get_unaligned_le32(&report[i]); break; } |