Index: device/hid/hid_connection.cc |
diff --git a/device/hid/hid_connection.cc b/device/hid/hid_connection.cc |
index 6ce2d7fd0024b20fbab5ad50647613f54500188e..c43667a2fc035299600958d1106cf8266804f044 100644 |
--- a/device/hid/hid_connection.cc |
+++ b/device/hid/hid_connection.cc |
@@ -99,6 +99,12 @@ void HidConnection::Write(scoped_refptr<net::IOBuffer> buffer, |
callback.Run(false); |
return; |
} |
+ if (size > device_info_->max_output_report_size() + 1) { |
+ VLOG(1) << "Output report buffer too long (" << size << " > " |
+ << (device_info_->max_output_report_size() + 1) << ")."; |
+ callback.Run(false); |
+ return; |
+ } |
DCHECK_GE(size, 1u); |
uint8_t report_id = buffer->data()[0]; |
if (device_info_->has_report_id() != (report_id != 0)) { |