From 93ae6efaf8a8740c5413333588e5c908cc14fa5e Mon Sep 17 00:00:00 2001 From: Min Chong Date: Fri, 2 Sep 2016 11:36:37 -0700 Subject: input: synaptics_dsx: add checks of user input data Add checks of the user input count to avoid possible heap overflow Signed-off-by: Min Chong Bug: 30937462 Git-repo: https://android.googlesource.com/kernel/msm.git Git-commit: a6accafb252a76256f11c83e28c556c8ca4b8e1f Change-Id: I6fc8323cbcf395a2c24e49e65cc7012709d031a2 Signed-off-by: Dennis Cagle --- drivers/input/touchscreen/synaptics_dsx/synaptics_dsx_fw_update.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/input/touchscreen/synaptics_dsx/synaptics_dsx_fw_update.c b/drivers/input/touchscreen/synaptics_dsx/synaptics_dsx_fw_update.c index 2282fe005bc7..f001706236ab 100644 --- a/drivers/input/touchscreen/synaptics_dsx/synaptics_dsx_fw_update.c +++ b/drivers/input/touchscreen/synaptics_dsx/synaptics_dsx_fw_update.c @@ -1606,6 +1606,13 @@ static ssize_t fwu_sysfs_store_image(struct file *data_file, struct kobject *kobj, struct bin_attribute *attributes, char *buf, loff_t pos, size_t count) { + if (count > (fwu->image_size - fwu->data_pos)) { + dev_err(fwu->rmi4_data->pdev->dev.parent, + "%s: Not enough space in buffer\n", + __func__); + return -EINVAL; + } + memcpy((void *)(&fwu->ext_data_source[fwu->data_pos]), (const void *)buf, count); -- cgit v1.2.3