diff options
| author | Vevek Venkatesan <vevekv@codeaurora.org> | 2016-12-23 11:34:32 +0530 |
|---|---|---|
| committer | Vevek Venkatesan <vevekv@codeaurora.org> | 2016-12-23 12:30:38 +0530 |
| commit | 73b5dafa887a528bdc6ece4f495b8c9f8ae28de8 (patch) | |
| tree | 7991d362c9212f0375e4f3b30812030d5b31c74b | |
| parent | ba4fdd9852b5a61b6a22385a9e6cab9ea78346b9 (diff) | |
input: misc: fix heap overflow issue in hbtp_input.c
Add the boundary check for ABS code before setting ABS params,
to avoid heap overflow.
Change-Id: I6aad9916c92d2f775632406374dbb803063148de
Signed-off-by: Vevek Venkatesan <vevekv@codeaurora.org>
| -rw-r--r-- | drivers/input/misc/hbtp_input.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/drivers/input/misc/hbtp_input.c b/drivers/input/misc/hbtp_input.c index 05cd1edefb7f..1df5d8812991 100644 --- a/drivers/input/misc/hbtp_input.c +++ b/drivers/input/misc/hbtp_input.c @@ -208,9 +208,13 @@ static int hbtp_input_create_input_dev(struct hbtp_input_absinfo *absinfo) input_mt_init_slots(input_dev, HBTP_MAX_FINGER, 0); for (i = 0; i <= ABS_MT_LAST - ABS_MT_FIRST; i++) { abs = absinfo + i; - if (abs->active) - input_set_abs_params(input_dev, abs->code, + if (abs->active) { + if (abs->code >= 0 && abs->code < ABS_CNT) + input_set_abs_params(input_dev, abs->code, abs->minimum, abs->maximum, 0, 0); + else + pr_err("%s: ABS code out of bound\n", __func__); + } } if (hbtp->override_disp_coords) { |