diff options
| author | Hongliang Yang <yanghongliang.yang@huawei.com> | 2018-07-04 02:49:41 +0000 |
|---|---|---|
| committer | Android Partner Code Review <android-gerrit-partner@google.com> | 2018-07-04 02:49:41 +0000 |
| commit | b1cbfd4c5191c3870cdc3aff388045195546c991 (patch) | |
| tree | 10a6760463d5b062ba865c0c0be9b88b4ab3bfdc | |
| parent | 7d9b17de05b514c299fe1174d4c4878b6e245ab5 (diff) | |
| parent | 19e8af555cddcfc33ad3b8f1974993f26dd8c1dc (diff) | |
Merge "Bluetooth: hidp: buffer overflow in hidp_process_report" into android-msm-sawshark-3.18-goldandroid-wear-8.0.0_r0.31
| -rw-r--r-- | net/bluetooth/hidp/core.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c index a34ea5176978..084ae63d3d89 100644 --- a/net/bluetooth/hidp/core.c +++ b/net/bluetooth/hidp/core.c @@ -415,8 +415,8 @@ static void hidp_del_timer(struct hidp_session *session) del_timer(&session->timer); } -static void hidp_process_report(struct hidp_session *session, - int type, const u8 *data, int len, int intr) +static void hidp_process_report(struct hidp_session *session, int type, + const u8 *data, unsigned int len, int intr) { if (len > HID_MAX_BUFFER_SIZE) len = HID_MAX_BUFFER_SIZE; |