HID: intel_ish-hid: Move header size check to inside the loop
authorHans de Goede <hdegoede@redhat.com>
Sat, 14 Apr 2018 15:06:44 +0000 (17:06 +0200)
committerJiri Kosina <jkosina@suse.cz>
Wed, 25 Apr 2018 08:52:42 +0000 (10:52 +0200)
commit37ba3c350e64adcbdd483e81bf194c05d9573515
tree250ee87fd3a8c4f1829a17fb74ed79709be6a510
parent097b8f62dd793e08f1732fc74dbb64596c7fbff9
HID: intel_ish-hid: Move header size check to inside the loop

With the headersize check outside of the loop, the second time through
the loop the: "payload_len = recv_msg->hdr.size;" statement may deref
recv_msg while it is pointing outside of our input buffer.

Move the headersize check to inside the loop to fix this.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
drivers/hid/intel-ish-hid/ishtp-hid-client.c