[PATCH 0/7] HID: roccat: validate raw report lengths

[Jiale Yao]

Roccat raw event callbacks receive the report before HID core validates
and pads its length.  Seven callbacks inspect fixed-format reports without
first ensuring that the complete report was received.

Add per-driver length checks before parsing or forwarding these reports.
The first five patches protect helpers which read fixed fields, while the
konepure and ryos patches additionally prevent a fixed-size copy of a
truncated report into the Roccat character-device event stream.

Each patch is independent and fixes the driver named in its subject.

Jiale Yao (7):
  HID: roccat: isku: reject short button reports
  HID: roccat: koneplus: reject short button reports
  HID: roccat: konepure: reject short button reports
  HID: roccat: kovaplus: reject short button reports
  HID: roccat: pyra: reject short button reports
  HID: roccat: ryos: reject short special reports
  HID: roccat: savu: reject short special reports

 drivers/hid/hid-roccat-isku.c     | 3 +++
 drivers/hid/hid-roccat-koneplus.c | 3 +++
 drivers/hid/hid-roccat-konepure.c | 3 +++
 drivers/hid/hid-roccat-kovaplus.c | 3 +++
 drivers/hid/hid-roccat-pyra.c     | 3 +++
 drivers/hid/hid-roccat-ryos.c     | 3 +++
 drivers/hid/hid-roccat-savu.c     | 3 +++
 7 files changed, 21 insertions(+)

-- 
2.34.1