Commit ed426d18 authored Aug 10, 2016 by chengengjia Committed by Dennis Cagle Nov 15, 2016

input: synaptics: Add checks of user input data



Add checks of the user input count to avoid possible heap overflow

Bug: 30799828
Change-Id: I896492b18c4ace6565fb9edd5cbf51f363ce157b
Signed-off-by: chengengjia <chengjia4574@gmail.com>
Signed-off-by: Andrew Chant <achant@google.com>
Git-repo: https://android.googlesource.com/kernel/msm.git


Git-commit: f549796fb9da58586c5cfc31d07b243c87dcfbd5
Signed-off-by: Dennis Cagle <d-cagle@codeaurora.org>

parent e4b06220

drivers/input/touchscreen/synaptics_fw_update.c

+7 −0

Original line number	Diff line number	Diff line
		@@ -1697,6 +1697,13 @@ static ssize_t fwu_sysfs_store_image(struct file *data_file,
		struct kobject kobj, struct bin_attribute attributes,
		char *buf, loff_t pos, size_t count)
		{
		if (count > fwu->image_size - fwu->data_pos) {
		dev_err(&fwu->rmi4_data->i2c_client->dev,
		"%s: Not enough space in buffer\n",
		__func__);
		return -EINVAL;
		}

		memcpy((void *)(&fwu->ext_data_source[fwu->data_pos]),
		(const void *)buf,
		count);