summaryrefslogtreecommitdiffstats
path: root/drivers/media/rc
diff options
context:
space:
mode:
authorGeorge Spelvin <linux@horizon.com>2014-05-11 08:12:09 -0300
committerMauro Carvalho Chehab <m.chehab@samsung.com>2014-07-25 23:44:23 -0300
commit20d7e3ca1be76a13fb4ea22246bb9d0c4c365809 (patch)
tree55145fffdb69774a882a38e0a4b1086271107716 /drivers/media/rc
parent7cec72ce00c174fd74d1183599d3d3dcc5dedc26 (diff)
downloadlinux-20d7e3ca1be76a13fb4ea22246bb9d0c4c365809.tar.bz2
[media] ati_remote: Check the checksum
An input report is 4 bytes long, but there are only 12 bits of actual payload. The 4 bytes are: data[0] = 0x14 data[1] = data[2] + data[3] + 0xd5 (a checksum byte) data[2] = the raw scancode (plus toggle bit in msbit) data[3] = channel << 4 (the low 4 bits must be zero) Ignore reports with a bad checksum. Signed-off-by: George Spelvin <linux@horizon.com> Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Diffstat (limited to 'drivers/media/rc')
-rw-r--r--drivers/media/rc/ati_remote.c9
1 files changed, 5 insertions, 4 deletions
diff --git a/drivers/media/rc/ati_remote.c b/drivers/media/rc/ati_remote.c
index 2e1335306eb3..52a5af610259 100644
--- a/drivers/media/rc/ati_remote.c
+++ b/drivers/media/rc/ati_remote.c
@@ -507,8 +507,9 @@ static void ati_remote_input_report(struct urb *urb)
*/
/* Deal with strange looking inputs */
- if ( (urb->actual_length != 4) || (data[0] != 0x14) ||
- ((data[3] & 0x0f) != 0x00) ) {
+ if ( urb->actual_length != 4 || data[0] != 0x14 ||
+ data[1] != (unsigned char)(data[2] + data[3] + 0xD5) ||
+ (data[3] & 0x0f) != 0x00) {
ati_remote_dump(&urb->dev->dev, data, urb->actual_length);
return;
}
@@ -524,9 +525,9 @@ static void ati_remote_input_report(struct urb *urb)
remote_num = (data[3] >> 4) & 0x0f;
if (channel_mask & (1 << (remote_num + 1))) {
dbginfo(&ati_remote->interface->dev,
- "Masked input from channel 0x%02x: data %02x,%02x, "
+ "Masked input from channel 0x%02x: data %02x, "
"mask= 0x%02lx\n",
- remote_num, data[1], data[2], channel_mask);
+ remote_num, data[2], channel_mask);
return;
}