From 2a767bd3e0b7277718a9a604cbe53e42830f025d Mon Sep 17 00:00:00 2001 From: Denis Benato Date: Fri, 19 Jun 2026 00:11:01 +0000 Subject: [PATCH] HID: asus: fix a off-by-one in mcu_parse_version_string() validation In mcu_parse_version_string() a size validation for response is stricter that it needs to be: relax the check by one byte. The device always answer with a greater byte count so this does not introduce visible changes. Fixes: ("hid-asus: check ROG Ally MCU version and warn") Signed-off-by: Denis Benato Signed-off-by: Jiri Kosina --- drivers/hid/hid-asus.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c index c7850ae2f8e1..0ad29de83cbf 100644 --- a/drivers/hid/hid-asus.c +++ b/drivers/hid/hid-asus.c @@ -841,7 +841,7 @@ static int mcu_parse_version_string(const u8 *response, size_t response_size) dots++; } - if (dots != 2 || p >= end || (p + 3) >= end) + if (dots != 2 || end - p < 3) return -EINVAL; memcpy(buf, p, 3);