Skip to content
Browse files

HID: picolcd: sanity check report size in raw_event() callback

The report passed to us from transport driver could potentially be
arbitrarily large, therefore we better sanity-check it so that raw_data
that we hold in picolcd_pending structure are always kept within proper

Reported-by: Steven Vittitoe <>
Signed-off-by: Jiri Kosina <>
  • Loading branch information...
Jiri Kosina
Jiri Kosina committed Aug 27, 2014
1 parent c54def7 commit 844817e47eef14141cf59b8d5ac08dd11c0a9189
Showing with 6 additions and 0 deletions.
  1. +6 −0 drivers/hid/hid-picolcd_core.c
@@ -350,6 +350,12 @@ static int picolcd_raw_event(struct hid_device *hdev,
if (!data)
return 1;

if (size > 64) {
hid_warn(hdev, "invalid size value (%d) for picolcd raw event\n",
return 0;

if (report->id == REPORT_KEY_STATE) {
if (data->input_keys)
ret = picolcd_raw_keypad(data, report, raw_data+1, size-1);

0 comments on commit 844817e

Please sign in to comment.
You can’t perform that action at this time.