[PATCH] HID: wacom: reject short input reports

[Jiale Yao]

wacom_raw_event() passes incoming reports to the pen serial extractor and
the device-specific IRQ parsers before the HID core validates the declared
report length. A short report can therefore make either consumer read past
the valid input data.

Require the complete report described by the HID report descriptor before
invoking either parser.

Signed-off-by: Jiale Yao <yaojiale02@xxxxxxx>
---
 drivers/hid/wacom_sys.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
index 40770affdbde..85e966e80012 100644
--- a/drivers/hid/wacom_sys.c
+++ b/drivers/hid/wacom_sys.c
@@ -175,6 +175,9 @@ static int wacom_raw_event(struct hid_device *hdev, struct hid_report *report,
 	if (wacom->wacom_wac.features.type == BOOTLOADER)
 		return 0;
 
+	if (size < hid_report_len(report))
+		return 0;
+
 	if (wacom_wac_pen_serial_enforce(hdev, report, raw_data, size))
 		return -1;
 
-- 
2.34.1