Store HID report sizes as uint16_t.

HID report sizes are unsigned values. In addition they should (because
of the limited size of USB control transfers) never be larger than 64k.
In reality that would be an absolutely enormous report and unlikely to
ever been seen in the wild. By limiting the storage size for report
lengths to a uint16_t we therefore also limit our exposure to being
convinced to allocate unreasonably large buffers by a malicious device.
The Windows HID parser already limits report sizes to a USHORT value.

BUG=

Review URL: https://codereview.chromium.org/492963007

Cr-Commit-Position: refs/heads/master@{#291624}

1 files changed, 3 insertions, 3 deletions

diff --git a/device/hid/hid_report_descriptor.h b/device/hid/hid_report_descriptor.h
index b5017b7..1719e94 100644
--- a/device/hid/hid_report_descriptor.h
+++ b/device/hid/hid_report_descriptor.h
@@ -29,9 +29,9 @@ class HidReportDescriptor {
   // together with max report sizes
   void GetDetails(std::vector<HidCollectionInfo>* top_level_collections,
                   bool* has_report_id,
-                  int* max_input_report_size,
-                  int* max_output_report_size,
-                  int* max_feature_report_size);
+                  uint16_t* max_input_report_size,
+                  uint16_t* max_output_report_size,
+                  uint16_t* max_feature_report_size);
 
  private:
   std::vector<linked_ptr<HidReportDescriptorItem> > items_;