From 5f2d538e10fc78f24d748f7a1f3721e0eaada32a Mon Sep 17 00:00:00 2001
From: Thomas Hindoe Paaboel Andersen <phomes@gmail.com>
Date: Wed, 2 Sep 2015 21:47:23 +0200
Subject: [PATCH] Avoid overflow when reading dpi list

LONG_MESSAGE_LENGTH is the length of the full message so we should
take the first parts of the union into account.
---
 src/hidpp20.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/hidpp20.c b/src/hidpp20.c
index d554e061..4779e5a8 100644
--- a/src/hidpp20.c
+++ b/src/hidpp20.c
@@ -779,7 +779,7 @@ hidpp20_adjustable_dpi_get_dpi_list(struct ratbag_device *device,
 	sensor->dpi_min = 0xffff;
 
 	sensor->index = msg.msg.parameters[0];
-	while (i < LONG_MESSAGE_LENGTH - 1 &&
+	while (i < LONG_MESSAGE_LENGTH - 4U &&
 	       hidpp20_get_unaligned_u16(&msg.msg.parameters[i]) != 0) {
 		uint16_t value = hidpp20_get_unaligned_u16(&msg.msg.parameters[i]);