From 20d7e3ca1be76a13fb4ea22246bb9d0c4c365809 Mon Sep 17 00:00:00 2001 From: George Spelvin Date: Sun, 11 May 2014 08:12:09 -0300 Subject: [PATCH] [media] ati_remote: Check the checksum An input report is 4 bytes long, but there are only 12 bits of actual payload. The 4 bytes are: data[0] = 0x14 data[1] = data[2] + data[3] + 0xd5 (a checksum byte) data[2] = the raw scancode (plus toggle bit in msbit) data[3] = channel << 4 (the low 4 bits must be zero) Ignore reports with a bad checksum. Signed-off-by: George Spelvin Signed-off-by: Mauro Carvalho Chehab --- drivers/media/rc/ati_remote.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/media/rc/ati_remote.c b/drivers/media/rc/ati_remote.c index 2e1335306eb3..52a5af610259 100644 --- a/drivers/media/rc/ati_remote.c +++ b/drivers/media/rc/ati_remote.c @@ -507,8 +507,9 @@ static void ati_remote_input_report(struct urb *urb) */ /* Deal with strange looking inputs */ - if ( (urb->actual_length != 4) || (data[0] != 0x14) || - ((data[3] & 0x0f) != 0x00) ) { + if ( urb->actual_length != 4 || data[0] != 0x14 || + data[1] != (unsigned char)(data[2] + data[3] + 0xD5) || + (data[3] & 0x0f) != 0x00) { ati_remote_dump(&urb->dev->dev, data, urb->actual_length); return; } @@ -524,9 +525,9 @@ static void ati_remote_input_report(struct urb *urb) remote_num = (data[3] >> 4) & 0x0f; if (channel_mask & (1 << (remote_num + 1))) { dbginfo(&ati_remote->interface->dev, - "Masked input from channel 0x%02x: data %02x,%02x, " + "Masked input from channel 0x%02x: data %02x, " "mask= 0x%02lx\n", - remote_num, data[1], data[2], channel_mask); + remote_num, data[2], channel_mask); return; } -- 2.39.5