[PATCH] Input: db9 - enlarge the Saturn multitap packet buffer

[Guanglei Zhu]

The Saturn multitap path fills the packet buffer block by block:

	for (i = 0; i < 60; i += 10) {
		data[i] = db9_saturn_read_analog(port, type, powered);
		if (data[i] != 0xff)
			/* read each pad */
			for (j = 0; j < (data[i] & 0x0f); j++)
				data[i + j + 1] = db9_saturn_read_analog(port, type, powered);
	}

Each block is ten bytes apart, and the low nibble of the block
header - taken from the device - allows up to fifteen more bytes,
so the last block can write up to data[65]. The buffer, however,
is sixty bytes, and the six bytes past it belong to the rest of
the stack frame.

Give the buffer the size the protocol layout actually requires.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Guanglei Zhu <zhugl3@xxxxxxxxxxxx>
---
 drivers/input/joystick/db9.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/input/joystick/db9.c b/drivers/input/joystick/db9.c
index e5d9b71aab99..73d1e7a296bb 100644
--- a/drivers/input/joystick/db9.c
+++ b/drivers/input/joystick/db9.c
@@ -253,7 +253,8 @@ static unsigned char db9_saturn_read_packet(struct parport *port, unsigned char
 /*
  * db9_saturn_report() analyzes packet and reports.
  */
-static int db9_saturn_report(unsigned char id, unsigned char data[60], struct input_dev *devs[], int n, int max_pads)
+static int db9_saturn_report(unsigned char id, unsigned char data[66],
+			      struct input_dev *devs[], int n, int max_pads)
 {
 	struct input_dev *dev;
 	int tmp, i, j;
@@ -321,7 +322,7 @@ static int db9_saturn_report(unsigned char id, unsigned char data[60], struct in
 
 static int db9_saturn(int mode, struct parport *port, struct input_dev *devs[])
 {
-	unsigned char id, data[60];
+	unsigned char id, data[66];
 	int type, n, max_pads;
 	int tmp, i;
 
-- 
2.50.1