Skip to contentSkip to conversation

HID: uclogic: fix limit in uclogic_tablet_enable()

PATCH In review Dan Carpenter 3 participants 3 messages Jul 29, 2015

Subsystems (2)
Kernel janitors HID
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 HID: uclogic: fix limit in uclogic_tablet_enable()

The limit should be ARRAY_SIZE(params) (5 elements) here instead of sizeof(params) (20 bytes).

Fixes 08177f40bd00 ('HID: uclogic: merge hid-huion driver in hid-uclogic')
Signed-off-by Dan Carpenter <[email protected]>
drivers/hid/hid-uclogic.c +1 -1
index 9416731..b905d50 100644
@@ -858,7 +858,7 @@ static int uclogic_tablet_enable(struct hid_device *hdev)
 	for (p = drvdata->rdesc;
 	     p <= drvdata->rdesc + drvdata->rsize - 4;) {
 		if (p[0] = 0xFE && p[1] = 0xED && p[2] = 0x1D &&
-		    p[3] < sizeof(params)) {
+		    p[3] < ARRAY_SIZE(params)) {
 			v = params[p[3]];
 			put_unaligned(cpu_to_le32(v), (s32 *)p);
 			p += 4;
Reviewed-by on v1 1/1
#1 lore raw
Quoted 11 lines · Dan Carpenter

The limit should be ARRAY_SIZE(params) (5 elements) here instead of sizeof(params) (20 bytes).

Fixes 08177f40bd00 ('HID: uclogic: merge hid-huion driver in hid-uclogic')
Signed-off-by Dan Carpenter <[email protected]>
drivers/hid/hid-uclogic.c +0 -0
index 9416731..b905d50 100644

drivers/hid/hid-uclogic.c static int uclogic_tablet_enable(struct hid_device *hdev) · line 864

Quoted 8 lines
drivers/hid/hid-uclogic.c +1 -1
@@ -858,7 +858,7 @@ static int uclogic_tablet_enable(struct hid_device *hdev)
  	for (p = drvdata->rdesc;
  	     p <= drvdata->rdesc + drvdata->rsize - 4;) {
  		if (p[0] = 0xFE && p[1] = 0xED && p[2] = 0x1D &&
-		    p[3] < sizeof(params)) {
+		    p[3] < ARRAY_SIZE(params)) {
  			v = params[p[3]];
  			put_unaligned(cpu_to_le32(v), (s32 *)p);
  			p += 4;

Argh, that's embarrassing. Thanks, Dan!

Reviewed-by Nikolai Kondrashov <[email protected]>

Nick

#2 lore raw
Quoted 7 lines · Nikolai Kondrashov
Quoted 6 lines · Dan Carpenter

The limit should be ARRAY_SIZE(params) (5 elements) here instead of sizeof(params) (20 bytes).

Fixes 08177f40bd00 ('HID: uclogic: merge hid-huion driver in hid-uclogic')
Signed-off-by Dan Carpenter <[email protected]>
Quoted 16 lines
Quoted 13 lines
drivers/hid/hid-uclogic.c +1 -1
index 9416731..b905d50 100644
@@ -858,7 +858,7 @@ static int uclogic_tablet_enable(struct hid_device
 *hdev)
  	for (p = drvdata->rdesc;
  	     p <= drvdata->rdesc + drvdata->rsize - 4;) {
  		if (p[0] = 0xFE && p[1] = 0xED && p[2] = 0x1D &&
-		    p[3] < sizeof(params)) {
+		    p[3] < ARRAY_SIZE(params)) {
  			v = params[p[3]];
  			put_unaligned(cpu_to_le32(v), (s32 *)p);
Quoted 1 line
  			p += 4;

Argh, that's embarrassing. Thanks, Dan!

Good catch Dan, thanks. Applied to for-4.2/upstream-fixes.

Signature · 2 lines
Jiri Kosina
SUSE Labs