[PATCH] Input: atmel_mxt_ts - validate firmware frame bounds
From: Pengpeng Hou <hidden>
Date: 2026-07-06 09:11:52
Also in:
lkml
Subsystem:
atmel maxtouch driver, input (keyboard, mouse, joystick, touchscreen) drivers, the rest · Maintainers:
Nick Dyer, Dmitry Torokhov, Linus Torvalds
From: Pengpeng <redacted> mxt_flash_fw() walks a length-prefixed firmware image. The loop only checks that the cursor is below fw->size before reading the two-byte frame length and passing the declared frame to the bootloader write path. Check that the length field and the complete frame, including CRC bytes, fit in the remaining firmware image before reading or writing the frame. Signed-off-by: Pengpeng <redacted> --- drivers/input/touchscreen/atmel_mxt_ts.c | 9 +++++++++ 1 file changed, 9 insertions(+)
diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c
index 2c0e5a67135b..2aa52b4e5ff5 100644
--- a/drivers/input/touchscreen/atmel_mxt_ts.c
+++ b/drivers/input/touchscreen/atmel_mxt_ts.c@@ -2927,10 +2927,19 @@ static int mxt_flash_fw(struct mxt_data *data, const struct firmware *fw) if (error) return error; + if (fw->size - pos < 2) { + dev_err(dev, "Truncated frame size in firmware\n"); + return -EINVAL; + } + frame_size = ((*(fw->data + pos) << 8) | *(fw->data + pos + 1)); /* Take account of CRC bytes */ frame_size += 2; + if (frame_size > fw->size - pos) { + dev_err(dev, "Truncated frame in firmware\n"); + return -EINVAL; + } /* Write one frame to device */ error = mxt_bootloader_write(data, fw->data + pos, frame_size);
--
2.43.0