From 0699858f389e0ccbaba3eedfc9a6db7d570fc720 Mon Sep 17 00:00:00 2001 From: "jaejoong.kim" Date: Tue, 19 Sep 2017 20:39:21 +0900 Subject: [PATCH] HID: usbhid: out of bound in hdesc->desc --- drivers/hid/usbhid/hid-core.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c index 089bad8..7b6a0b6 100644 --- a/drivers/hid/usbhid/hid-core.c +++ b/drivers/hid/usbhid/hid-core.c @@ -974,7 +974,7 @@ static int usbhid_parse(struct hid_device *hid) u32 quirks = 0; unsigned int rsize = 0; char *rdesc; - int ret, n; + int ret; quirks = usbhid_lookup_quirk(le16_to_cpu(dev->descriptor.idVendor), le16_to_cpu(dev->descriptor.idProduct)); @@ -1000,9 +1000,8 @@ static int usbhid_parse(struct hid_device *hid) hid->version = le16_to_cpu(hdesc->bcdHID); hid->country = hdesc->bCountryCode; - for (n = 0; n < hdesc->bNumDescriptors; n++) - if (hdesc->desc[n].bDescriptorType == HID_DT_REPORT) - rsize = le16_to_cpu(hdesc->desc[n].wDescriptorLength); + if (hdesc->desc[0].bDescriptorType == HID_DT_REPORT) + rsize = le16_to_cpu(hdesc->desc[0].wDescriptorLength); if (!rsize || rsize > HID_MAX_DESCRIPTOR_SIZE) { dbg_hid("weird size of report descriptor (%u)\n", rsize); -- 2.7.4