From: Jiri Kosina <jkosina@suse.cz>
Date: Thu, 6 Dec 2012 09:59:28 +0000 (+0100)
Subject: HID: i2c-hid: fix ret_count check
X-Git-Url: https://git.karo-electronics.de/?a=commitdiff_plain;h=9afd09a1db93cc9084846c2b9bc0d1194743e5dc;p=linux-beck.git

HID: i2c-hid: fix ret_count check

ret_count has to be at least 3, as we have to count the 2 bytes that are used
for the size of the reply. Without this, memcpy() might be called with zero or
negative count.

Reported-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
---

diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c
index ce01d5916184..6e1774c3a3f9 100644
--- a/drivers/hid/i2c-hid/i2c-hid.c
+++ b/drivers/hid/i2c-hid/i2c-hid.c
@@ -520,7 +520,7 @@ static int i2c_hid_get_raw_report(struct hid_device *hid,
 
 	ret_count = ihid->inbuf[0] | (ihid->inbuf[1] << 8);
 
-	if (!ret_count)
+	if (ret_count <= 2)
 		return 0;
 
 	ret_count = min(ret_count, ask_count);