Re: [PATCH v2 4/4] HID: i2c-hid: fix i2c_hid_get_raw_report count mismatches

2012-12-07 Thread Benjamin Tissoires
On Thu, Dec 6, 2012 at 11:01 AM, Jiri Kosina wrote: >> > - count = ihid->inbuf[0] | (ihid->inbuf[1] << 8); >> > + ret_count = ihid->inbuf[0] | (ihid->inbuf[1] << 8); >> > >> > + if (!ret_count) >> >> I'd make this (ret_count <= 2), as this would let you call memcpy with a >> null or even

Re: [PATCH v2 4/4] HID: i2c-hid: fix i2c_hid_get_raw_report count mismatches

2012-12-07 Thread Benjamin Tissoires
On Thu, Dec 6, 2012 at 11:01 AM, Jiri Kosina jkos...@suse.cz wrote: - count = ihid-inbuf[0] | (ihid-inbuf[1] 8); + ret_count = ihid-inbuf[0] | (ihid-inbuf[1] 8); + if (!ret_count) I'd make this (ret_count = 2), as this would let you call memcpy with a null or even negative

Re: [PATCH v2 4/4] HID: i2c-hid: fix i2c_hid_get_raw_report count mismatches

2012-12-06 Thread Jiri Kosina
On Wed, 5 Dec 2012, Jean Delvare wrote: > > The previous memcpy implementation relied on the size advertized by the > > device. There were no guarantees that buf was big enough. > > > > Some gymnastic is also required with the +2/-2 to take into account > > the first 2 bytes of the returned

Re: [PATCH v2 4/4] HID: i2c-hid: fix i2c_hid_get_raw_report count mismatches

2012-12-06 Thread Jiri Kosina
On Wed, 5 Dec 2012, Jean Delvare wrote: The previous memcpy implementation relied on the size advertized by the device. There were no guarantees that buf was big enough. Some gymnastic is also required with the +2/-2 to take into account the first 2 bytes of the returned buffer where

Re: [PATCH v2 4/4] HID: i2c-hid: fix i2c_hid_get_raw_report count mismatches

2012-12-05 Thread Jean Delvare
On Wed, 5 Dec 2012 15:02:56 +0100, Benjamin Tissoires wrote: > The previous memcpy implementation relied on the size advertized by the > device. There were no guarantees that buf was big enough. > > Some gymnastic is also required with the +2/-2 to take into account > the first 2 bytes of the

Re: [PATCH v2 4/4] HID: i2c-hid: fix i2c_hid_get_raw_report count mismatches

2012-12-05 Thread Jean Delvare
On Wed, 5 Dec 2012 15:02:56 +0100, Benjamin Tissoires wrote: The previous memcpy implementation relied on the size advertized by the device. There were no guarantees that buf was big enough. Some gymnastic is also required with the +2/-2 to take into account the first 2 bytes of the