diff options
| author | Min Chong <mchong@google.com> | 2016-09-02 11:36:37 -0700 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2016-11-23 03:27:01 -0800 |
| commit | 93ae6efaf8a8740c5413333588e5c908cc14fa5e (patch) | |
| tree | 0f721321a0126a8cbb9d44cbd20bed051bb4b2ad /drivers/input/touchscreen/synaptics_dsx | |
| parent | 9febdfdde008c8d7875b5186a4a37cb515cb924d (diff) | |
input: synaptics_dsx: add checks of user input data
Add checks of the user input count to avoid possible heap overflow
Signed-off-by: Min Chong <mchong@google.com>
Bug: 30937462
Git-repo: https://android.googlesource.com/kernel/msm.git
Git-commit: a6accafb252a76256f11c83e28c556c8ca4b8e1f
Change-Id: I6fc8323cbcf395a2c24e49e65cc7012709d031a2
Signed-off-by: Dennis Cagle <d-cagle@codeaurora.org>
Diffstat (limited to 'drivers/input/touchscreen/synaptics_dsx')
| -rw-r--r-- | drivers/input/touchscreen/synaptics_dsx/synaptics_dsx_fw_update.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/drivers/input/touchscreen/synaptics_dsx/synaptics_dsx_fw_update.c b/drivers/input/touchscreen/synaptics_dsx/synaptics_dsx_fw_update.c index 2282fe005bc7..f001706236ab 100644 --- a/drivers/input/touchscreen/synaptics_dsx/synaptics_dsx_fw_update.c +++ b/drivers/input/touchscreen/synaptics_dsx/synaptics_dsx_fw_update.c @@ -1606,6 +1606,13 @@ static ssize_t fwu_sysfs_store_image(struct file *data_file, struct kobject *kobj, struct bin_attribute *attributes, char *buf, loff_t pos, size_t count) { + if (count > (fwu->image_size - fwu->data_pos)) { + dev_err(fwu->rmi4_data->pdev->dev.parent, + "%s: Not enough space in buffer\n", + __func__); + return -EINVAL; + } + memcpy((void *)(&fwu->ext_data_source[fwu->data_pos]), (const void *)buf, count); |