[PATCH] Input: zforce - don't overwrite the stack

Subsystems: input (keyboard, mouse, joystick, touchscreen) drivers, the rest

STALE4076d

2 messages, 2 authors, 2015-07-13 · open the first message on its own page

[PATCH] Input: zforce - don't overwrite the stack

From: Dirk Behme <hidden>
Date: 2015-07-13 12:45:18 

From: Oleksij Rempel <redacted>

If we get a corrupted packet with PAYLOAD_LENGTH > FRAME_MAXSIZE, we
will silently overwrite the stack.

Signed-off-by: Oleksij Rempel <redacted>
Signed-off-by: Dirk Behme <redacted>
---
 drivers/input/touchscreen/zforce_ts.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/input/touchscreen/zforce_ts.c b/drivers/input/touchscreen/zforce_ts.c
index c4cffcf..32749db 100644
--- a/drivers/input/touchscreen/zforce_ts.c
+++ b/drivers/input/touchscreen/zforce_ts.c
@@ -441,7 +441,7 @@ static int zforce_read_packet(struct zforce_ts *ts, u8 *buf)
 		goto unlock;
 	}
 
-	if (buf[PAYLOAD_LENGTH] == 0) {
+	if (buf[PAYLOAD_LENGTH] == 0 || buf[PAYLOAD_LENGTH] > FRAME_MAXSIZE) {
 		dev_err(&client->dev, "invalid payload length: %d\n",
 			buf[PAYLOAD_LENGTH]);
 		ret = -EIO;
-- 
2.3.4

Re: [PATCH] Input: zforce - don't overwrite the stack

From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Date: 2015-07-13 17:02:30 

On Mon, Jul 13, 2015 at 02:45:12PM +0200, Dirk Behme wrote:
From: Oleksij Rempel <redacted>

If we get a corrupted packet with PAYLOAD_LENGTH > FRAME_MAXSIZE, we
will silently overwrite the stack.

Signed-off-by: Oleksij Rempel <redacted>
Signed-off-by: Dirk Behme <redacted>
Applied, thank you.
quoted hunk
---
 drivers/input/touchscreen/zforce_ts.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/input/touchscreen/zforce_ts.c b/drivers/input/touchscreen/zforce_ts.c
index c4cffcf..32749db 100644
--- a/drivers/input/touchscreen/zforce_ts.c
+++ b/drivers/input/touchscreen/zforce_ts.c
@@ -441,7 +441,7 @@ static int zforce_read_packet(struct zforce_ts *ts, u8 *buf)
 		goto unlock;
 	}
 
-	if (buf[PAYLOAD_LENGTH] == 0) {
+	if (buf[PAYLOAD_LENGTH] == 0 || buf[PAYLOAD_LENGTH] > FRAME_MAXSIZE) {
 		dev_err(&client->dev, "invalid payload length: %d\n",
 			buf[PAYLOAD_LENGTH]);
 		ret = -EIO;
-- 
2.3.4
-- 
Dmitry
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help