Index: usb-devel/drivers/hid/hid-core.c =================================================================== --- usb-devel.orig/drivers/hid/hid-core.c +++ usb-devel/drivers/hid/hid-core.c @@ -464,7 +464,8 @@ static int hid_parser_global(struct hid_ case HID_GLOBAL_ITEM_TAG_REPORT_SIZE: parser->global.report_size = item_udata(item); - if (parser->global.report_size > 256) { + if (parser->global.report_size > 256 || + parser->global.report_size == 0) { hid_err(parser->device, "invalid report_size %d\n", parser->global.report_size); return -1; @@ -473,7 +474,8 @@ static int hid_parser_global(struct hid_ case HID_GLOBAL_ITEM_TAG_REPORT_COUNT: parser->global.report_count = item_udata(item); - if (parser->global.report_count > HID_MAX_USAGES) { + if (parser->global.report_count > HID_MAX_USAGES || + parser->global.report_count == 0) { hid_err(parser->device, "invalid report_count %d\n", parser->global.report_count); return -1;