diff options
| author | Linux Build Service Account <lnxbuild@localhost> | 2016-11-25 17:47:05 -0800 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2016-11-25 17:47:04 -0800 |
| commit | 74d0e8e4ca3f4094d31dc6d3beecd0c1270ee287 (patch) | |
| tree | f46ebef009dd5a062cecabbfcc33ec79d949ffdf | |
| parent | fdc9a3b7d5699d2139b05a6daff548dc6c59b293 (diff) | |
| parent | 93ae6efaf8a8740c5413333588e5c908cc14fa5e (diff) | |
Merge "input: synaptics_dsx: add checks of user input data"
| -rw-r--r-- | drivers/input/touchscreen/synaptics_dsx/synaptics_dsx_fw_update.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/drivers/input/touchscreen/synaptics_dsx/synaptics_dsx_fw_update.c b/drivers/input/touchscreen/synaptics_dsx/synaptics_dsx_fw_update.c index 2282fe005bc7..f001706236ab 100644 --- a/drivers/input/touchscreen/synaptics_dsx/synaptics_dsx_fw_update.c +++ b/drivers/input/touchscreen/synaptics_dsx/synaptics_dsx_fw_update.c @@ -1606,6 +1606,13 @@ static ssize_t fwu_sysfs_store_image(struct file *data_file, struct kobject *kobj, struct bin_attribute *attributes, char *buf, loff_t pos, size_t count) { + if (count > (fwu->image_size - fwu->data_pos)) { + dev_err(fwu->rmi4_data->pdev->dev.parent, + "%s: Not enough space in buffer\n", + __func__); + return -EINVAL; + } + memcpy((void *)(&fwu->ext_data_source[fwu->data_pos]), (const void *)buf, count); |