HID: fix a crash in hid_report_raw_event() function.

avisconti · Jiri Kosina · commit 966922f26c7f · 2011-05-20T10:25:23.000+02:00
I'm using a Data Modul EasyTouch USB multitouch controller,
which is issuing a hid report with a size equals to 0. The rsize
value gets set to 536870912 and Linux is crashing in the memset
because the value is too big.

Signed-off-by: Armando Visconti &lt;armando.visconti@st.com&gt;
Signed-off-by: Jiri Kosina &lt;jkosina@suse.cz&gt;
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
@@ -1045,6 +1045,9 @@ void hid_report_raw_event(struct hid_device *hid, int type, u8 *data, int size,
 
 	rsize = ((report->size - 1) >> 3) + 1;
 
+	if (rsize > HID_MAX_BUFFER_SIZE)
+		rsize = HID_MAX_BUFFER_SIZE;
+
 	if (csize < rsize) {
 		dbg_hid("report %d is too short, (%d < %d)\n", report->id,
 				csize, rsize);
