Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0d0d4d21 authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman
Browse files

staging: fbtft: array underflow in fbtft_request_gpios_match() 



"val" can be negative, so we'd write before the start of the
par->gpio.db[] array.

Fixes: c296d5f9 ("staging: fbtft: core support")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent c2d79b4b

drivers/staging/fbtft/fbtft-core.c

+2 −2
Original line number Diff line number Diff line
@@ -84,7 +84,7 @@ static unsigned long fbtft_request_gpios_match(struct fbtft_par *par, 
					       const struct fbtft_gpio *gpio)

{

	int ret;

	long val;

	unsigned int val;



	fbtft_par_dbg(DEBUG_REQUEST_GPIOS_MATCH, par, "%s('%s')\n",

		      __func__, gpio->name);
@@ -108,7 +108,7 @@ static unsigned long fbtft_request_gpios_match(struct fbtft_par *par, 
		par->gpio.latch = gpio->gpio;

		return GPIOF_OUT_INIT_LOW;

	} else if (gpio->name[0] == 'd' && gpio->name[1] == 'b') {

		ret = kstrtol(&gpio->name[2], 10, &val);

		ret = kstrtouint(&gpio->name[2], 10, &val);

		if (ret == 0 && val < 16) {

			par->gpio.db[val] = gpio->gpio;

			return GPIOF_OUT_INIT_LOW;