Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5f6d976e authored by Venkata Prahlad Valluru's avatar Venkata Prahlad Valluru Committed by Gerrit - the friendly Code Review server
Browse files

input: touchscreen: synaptics_dsx: Fix buffer overflow 



Limit the index to buffer length while copying from
'strptr' to 'firmware_id'.

Change-Id: I1d7cb7a3d9593ca213c7f7341776632e635eb0df
Signed-off-by: default avatarVenkata Prahlad Valluru <vvalluru@codeaurora.org>
parent 31994032

drivers/input/touchscreen/synaptics_dsx/synaptics_dsx_fw_update.c

+3 −1
Original line number Diff line number Diff line
@@ -681,10 +681,12 @@ static enum flash_area fwu_go_nogo(struct image_header_data *header) 
			goto exit;

		}



		while (strptr[index] >= '0' && strptr[index] <= '9') {

		while ((index < MAX_FIRMWARE_ID_LEN - 1) && strptr[index] >= '0'

						&& strptr[index] <= '9') {

			firmware_id[index] = strptr[index];

			index++;

		}

		firmware_id[index] = '\0';



		retval = sstrtoul(firmware_id, 10, &image_fw_id);

		kfree(firmware_id);