summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorLinux Build Service Account <lnxbuild@localhost>2018-05-08 13:45:51 -0700
committerGerrit - the friendly Code Review server <code-review@localhost>2018-05-08 13:45:49 -0700
commit78cb670fd21500ce18c4b01f204e12ec3bcde6bc (patch)
treeb84ffec2a9086270ccd6a2add22c2969ea499715
parent46b4f44537f52cedeae34005c3d8758d457d0fd8 (diff)
parent4b4771bdcacd5d3d2e5af1d1149b0f59572ad098 (diff)
Merge "input: touchscreen: synaptics_dsx: Fix buffer overflow"
-rw-r--r--drivers/input/touchscreen/synaptics_dsx/synaptics_dsx_fw_update.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/input/touchscreen/synaptics_dsx/synaptics_dsx_fw_update.c b/drivers/input/touchscreen/synaptics_dsx/synaptics_dsx_fw_update.c
index 4787f2bcd768..13680130c2de 100644
--- a/drivers/input/touchscreen/synaptics_dsx/synaptics_dsx_fw_update.c
+++ b/drivers/input/touchscreen/synaptics_dsx/synaptics_dsx_fw_update.c
@@ -681,10 +681,12 @@ static enum flash_area fwu_go_nogo(struct image_header_data *header)
goto exit;
}
- while (strptr[index] >= '0' && strptr[index] <= '9') {
+ while ((index < MAX_FIRMWARE_ID_LEN - 1) && strptr[index] >= '0'
+ && strptr[index] <= '9') {
firmware_id[index] = strptr[index];
index++;
}
+ firmware_id[index] = '\0';
retval = sstrtoul(firmware_id, 10, &image_fw_id);
kfree(firmware_id);