Commit cd610457 authored by Adam Kropelin's avatar Adam Kropelin Committed by Linus Torvalds

[PATCH] hid-core: Zero-pad truncated reports

When it detects a truncated report, hid-core emits a warning and then
processes the report as usual.  This is good because it allows buggy
devices to still get data thru to userspace.  However, the missing bytes of
the report should be cleared before processing, otherwise userspace will be
handed partially-uninitialized data.

This fixes Debian tracker bug #330487.
Signed-off-by: default avatarAdam Kropelin <akropel1@rochester.rr.com>
Cc: Vojtech Pavlik <vojtech@suse.cz>
Acked-by: default avatarDmitry Torokhov <dtor_core@ameritech.net>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent fb79ffa4
...@@ -893,8 +893,10 @@ static int hid_input_report(int type, struct urb *urb, int interrupt, struct pt_ ...@@ -893,8 +893,10 @@ static int hid_input_report(int type, struct urb *urb, int interrupt, struct pt_
size = ((report->size - 1) >> 3) + 1; size = ((report->size - 1) >> 3) + 1;
if (len < size) if (len < size) {
dbg("report %d is too short, (%d < %d)", report->id, len, size); dbg("report %d is too short, (%d < %d)", report->id, len, size);
memset(data + len, 0, size - len);
}
if (hid->claimed & HID_CLAIMED_HIDDEV) if (hid->claimed & HID_CLAIMED_HIDDEV)
hiddev_report_event(hid, report); hiddev_report_event(hid, report);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment