Re: [PATCH] Input: zforce - don't overwrite the stack
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Date: 2015-07-13 17:02:30
On Mon, Jul 13, 2015 at 02:45:12PM +0200, Dirk Behme wrote:
From: Oleksij Rempel <redacted> If we get a corrupted packet with PAYLOAD_LENGTH > FRAME_MAXSIZE, we will silently overwrite the stack. Signed-off-by: Oleksij Rempel <redacted> Signed-off-by: Dirk Behme <redacted>
Applied, thank you.
quoted hunk ↗ jump to hunk
--- drivers/input/touchscreen/zforce_ts.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)diff --git a/drivers/input/touchscreen/zforce_ts.c b/drivers/input/touchscreen/zforce_ts.c index c4cffcf..32749db 100644 --- a/drivers/input/touchscreen/zforce_ts.c +++ b/drivers/input/touchscreen/zforce_ts.c@@ -441,7 +441,7 @@ static int zforce_read_packet(struct zforce_ts *ts, u8 *buf) goto unlock; } - if (buf[PAYLOAD_LENGTH] == 0) { + if (buf[PAYLOAD_LENGTH] == 0 || buf[PAYLOAD_LENGTH] > FRAME_MAXSIZE) { dev_err(&client->dev, "invalid payload length: %d\n", buf[PAYLOAD_LENGTH]); ret = -EIO;-- 2.3.4
-- Dmitry