diff options
| author | Hans de Goede <[email protected]> | 2018-04-14 15:06:44 +0000 |
|---|---|---|
| committer | Jiri Kosina <[email protected]> | 2018-04-25 08:52:42 +0000 |
| commit | 37ba3c350e64adcbdd483e81bf194c05d9573515 (patch) | |
| tree | 250ee87fd3a8c4f1829a17fb74ed79709be6a510 /lib/netdev-notifier-error-inject.c | |
| parent | HID: wacom: Release device resource data obtained by devres_alloc() (diff) | |
| download | kernel-37ba3c350e64adcbdd483e81bf194c05d9573515.tar.gz kernel-37ba3c350e64adcbdd483e81bf194c05d9573515.zip | |
HID: intel_ish-hid: Move header size check to inside the loop
With the headersize check outside of the loop, the second time through
the loop the: "payload_len = recv_msg->hdr.size;" statement may deref
recv_msg while it is pointing outside of our input buffer.
Move the headersize check to inside the loop to fix this.
Signed-off-by: Hans de Goede <[email protected]>
Reviewed-by: Benjamin Tissoires <[email protected]>
Acked-by: Srinivas Pandruvada <[email protected]>
Signed-off-by: Jiri Kosina <[email protected]>
Diffstat (limited to 'lib/netdev-notifier-error-inject.c')
0 files changed, 0 insertions, 0 deletions