CHROMIUM: HID: i2c-hid: allocate hid buffers for real worst case
The buffer allocation is not currently accounting for an extra byte for
the report id. This can cause an out of bounds access in function
i2c_hid_set_or_send_report() with reportID > 15.
BUG=b:37233061, chromium:582394
TEST=Build and boot Ryu, run provided pwrite64 executable
Change-Id: I1a790ad18d02b996dc08a56a122843c707197626
Signed-off-by: Adrian Salido <salidoa@google.com>
Signed-off-by: Guenter Roeck <groeck@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/475932
(cherry picked from commit a473392cd6c26b5dcd941e68b8bbe0297cde2008)
Reviewed-on: https://chromium-review.googlesource.com/477496
Reviewed-by: Dmitry Torokhov <dtor@chromium.org>
1 file changed
