diff options
| author | Venkata Prahlad Valluru <vvalluru@codeaurora.org> | 2018-05-01 11:23:32 +0530 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2018-05-01 01:38:15 -0700 |
| commit | 4b4771bdcacd5d3d2e5af1d1149b0f59572ad098 (patch) | |
| tree | 75f1ee280e06e3532c93a6e89f1eee03a26ee0d3 | |
| parent | 866d379212a6aa6eb461bc9a62dabc7521ceebd5 (diff) | |
input: touchscreen: synaptics_dsx: Fix buffer overflow
Limit the index to buffer length while copying from
'strptr' to 'firmware_id'.
Change-Id: I1d7cb7a3d9593ca213c7f7341776632e635eb0df
Signed-off-by: Venkata Prahlad Valluru <vvalluru@codeaurora.org>
| -rw-r--r-- | drivers/input/touchscreen/synaptics_dsx/synaptics_dsx_fw_update.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/input/touchscreen/synaptics_dsx/synaptics_dsx_fw_update.c b/drivers/input/touchscreen/synaptics_dsx/synaptics_dsx_fw_update.c index 4787f2bcd768..13680130c2de 100644 --- a/drivers/input/touchscreen/synaptics_dsx/synaptics_dsx_fw_update.c +++ b/drivers/input/touchscreen/synaptics_dsx/synaptics_dsx_fw_update.c @@ -681,10 +681,12 @@ static enum flash_area fwu_go_nogo(struct image_header_data *header) goto exit; } - while (strptr[index] >= '0' && strptr[index] <= '9') { + while ((index < MAX_FIRMWARE_ID_LEN - 1) && strptr[index] >= '0' + && strptr[index] <= '9') { firmware_id[index] = strptr[index]; index++; } + firmware_id[index] = '\0'; retval = sstrtoul(firmware_id, 10, &image_fw_id); kfree(firmware_id); |