HID: core: Correctly handle ReportSize being zero
authorMarc Zyngier <maz@kernel.org>
Sat, 29 Aug 2020 11:26:01 +0000 (12:26 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 12 Sep 2020 09:47:31 +0000 (11:47 +0200)
commitcf7797ea60e3e721e3ae5090edbc2ec72d715436
treeb7cd075f6ccdb89e8c447911237d72fff518fabe
parent90bf2565b75363faf5fff41f0b2108ec2a288be8
HID: core: Correctly handle ReportSize being zero

commit bce1305c0ece3dc549663605e567655dd701752c upstream.

It appears that a ReportSize value of zero is legal, even if a bit
non-sensical. Most of the HID code seems to handle that gracefully,
except when computing the total size in bytes. When fed as input to
memset, this leads to some funky outcomes.

Detect the corner case and correctly compute the size.

Cc: stable@vger.kernel.org
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/hid/hid-core.c