diff options
| author | Linux Build Service Account <lnxbuild@localhost> | 2018-07-25 05:33:33 -0700 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2018-07-25 05:33:33 -0700 |
| commit | 640c42099bfa88171dbdffa0d0a0c73820b11a56 (patch) | |
| tree | f9163a301882c9cafb0acc7b5671b9737f5e4a5c | |
| parent | e1ec56a731502f4db8ec3f1890f43e7771f59aea (diff) | |
| parent | 4d4a179e76a105a67746d6119a5417414bf009ce (diff) | |
Merge "ANDROID: Bluetooth: hidp: buffer overflow in hidp_process_report"
| -rw-r--r-- | net/bluetooth/hidp/core.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c index f64de569175a..a295b5ec9d4a 100644 --- a/net/bluetooth/hidp/core.c +++ b/net/bluetooth/hidp/core.c @@ -431,8 +431,8 @@ static void hidp_del_timer(struct hidp_session *session) del_timer(&session->timer); } -static void hidp_process_report(struct hidp_session *session, - int type, const u8 *data, int len, int intr) +static void hidp_process_report(struct hidp_session *session, int type, + const u8 *data, unsigned int len, int intr) { if (len > HID_MAX_BUFFER_SIZE) len = HID_MAX_BUFFER_SIZE; |