[PATCH] staging: fbtft: fix len<=0 buffer overflow in define_fbtft_write_reg()

[Anshika Jain <anshikajain196872@gmail.com>]

If len is 0 or negative when a define_fbtft_write_reg()-generated
function is called, len-- underflows to -1, causing the subsequent
while (i--) loop to run approximately 2^31 times and write far past
the end of buf.

This is a latent bug: nothing in the current code prevents two
adjacent negative values in an init_sequence from producing len=0,
and there is no guarantee future or out-of-tree panel definitions
won't do so.

Add an early return for len <= 0, matching the existing guard already
present in the sibling function fbtft_write_reg8_bus9().

Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Link: https://sashiko.dev/#/patchset/20260830161529.14500-1-anshikajain196872@gmail.com?part=1

Signed-off-by: Anshika Jain <anshikajain196872@gmail.com>
---
 drivers/staging/fbtft/fbtft-bus.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/staging/fbtft/fbtft-bus.c b/drivers/staging/fbtft/fbtft-bus.c
index e03aa251c..7d7135571 100644
--- a/drivers/staging/fbtft/fbtft-bus.c
+++ b/drivers/staging/fbtft/fbtft-bus.c
@@ -20,6 +20,9 @@ void func(struct fbtft_par *par, int len, ...)                                \
 	int offset = 0;                                                       \
 	buffer_type *buf = (buffer_type *)par->buf;                           \
 									      \
+	if (len <= 0)                                                         \
+		return;                                                       \
+									      \
 	if (unlikely(par->debug & DEBUG_WRITE_REGISTER)) {                    \
 		va_start(args, len);                                          \
 		for (i = 0; i < len; i++) {                                   \
-- 
2.34.1