diff options
| -rw-r--r-- | drivers/video/fbdev/msm/mdss_debug.c | 17 |
1 files changed, 14 insertions, 3 deletions
diff --git a/drivers/video/fbdev/msm/mdss_debug.c b/drivers/video/fbdev/msm/mdss_debug.c index c520d4cb1493..3436db661e87 100644 --- a/drivers/video/fbdev/msm/mdss_debug.c +++ b/drivers/video/fbdev/msm/mdss_debug.c @@ -39,6 +39,9 @@ #define PANEL_CMD_MIN_TX_COUNT 2 #define PANEL_DATA_NODE_LEN 80 +/* Hex number + whitespace */ +#define NEXT_VALUE_OFFSET 3 + #define INVALID_XIN_ID 0xFF static char panel_reg[2] = {DEFAULT_READ_PANEL_POWER_MODE_REG, 0x00}; @@ -129,7 +132,7 @@ static ssize_t panel_debug_base_reg_write(struct file *file, struct mdss_debug_base *dbg = file->private_data; char buf[PANEL_TX_MAX_BUF] = {0x0}; char reg[PANEL_TX_MAX_BUF] = {0x0}; - u32 len = 0, step = 0, value = 0; + u32 len = 0, value = 0; char *bufp; struct mdss_data_type *mdata = mdss_res; @@ -152,13 +155,21 @@ static ssize_t panel_debug_base_reg_write(struct file *file, buf[count] = 0; /* end of string */ bufp = buf; - while (sscanf(bufp, "%x%n", &value, &step) > 0) { + /* End of a hex value in given string */ + bufp[NEXT_VALUE_OFFSET - 1] = 0; + while (kstrtouint(bufp, 16, &value) == 0) { reg[len++] = value; if (len >= PANEL_TX_MAX_BUF) { pr_err("wrong input reg len\n"); return -EFAULT; } - bufp += step; + bufp += NEXT_VALUE_OFFSET; + if ((bufp >= (buf + count)) || (bufp < buf)) { + pr_warn("%s,buffer out-of-bounds\n", __func__); + break; + } + /* End of a hex value in given string */ + bufp[NEXT_VALUE_OFFSET - 1] = 0; } if (len < PANEL_CMD_MIN_TX_COUNT) { pr_err("wrong input reg len\n"); |