[PATCH] Input: usbtouchscreen - validate Nexio reply length

[Pengpeng Hou]

nexio_init() accepts replies with actual_len == 1 and then reads buf[1]
to compare the embedded length.

Require at least two bytes before checking the embedded reply length.

Signed-off-by: Pengpeng Hou <pengpeng@xxxxxxxxxxx>
---
 drivers/input/touchscreen/usbtouchscreen.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/input/touchscreen/usbtouchscreen.c b/drivers/input/touchscreen/usbtouchscreen.c
index 0bbacb5..0e07bcc 100644
--- a/drivers/input/touchscreen/usbtouchscreen.c
+++ b/drivers/input/touchscreen/usbtouchscreen.c
@@ -1011,7 +1011,7 @@ static int nexio_init(struct usbtouch_usb *usbtouch)
 		ret = usb_bulk_msg(dev, usb_rcvbulkpipe(dev, input_ep),
 				   buf, NEXIO_BUFSIZE, &actual_len,
 				   NEXIO_TIMEOUT);
-		if (ret < 0 || actual_len < 1 || buf[1] != actual_len)
+		if (ret < 0 || actual_len < 2 || buf[1] != actual_len)
 			continue;
 		switch (buf[0]) {
 		case 0x83:	/* firmware version */