From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ferruh Yigit Subject: [PATCH 1/2] Input: cyttsp - fix memcpy size param Date: Fri, 10 May 2013 16:32:48 +0300 Message-ID: <1368192769-24067-1-git-send-email-fery@cypress.com> Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7BIT Return-path: Received: from relay-s04-hub003.domainlocalhost.com ([74.115.207.102]:20942 "EHLO relay-S04-HUB003.domainlocalhost.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752707Ab3EJNih convert rfc822-to-8bit (ORCPT ); Fri, 10 May 2013 09:38:37 -0400 Sender: linux-input-owner@vger.kernel.org List-Id: linux-input@vger.kernel.org To: Dmitry Torokhov Cc: ttdrivers@cypress.com, Ferruh Yigit , Javier Martinez Canillas , linux-input@vger.kernel.org, linux-kernel@vger.kernel.org memcpy param is wrong because of offset in bl_cmd, this may corrupt the stack which may cause a crash. Tested-by: Ferruh Yigit on TMA300-DVK Signed-off-by: Ferruh Yigit --- drivers/input/touchscreen/cyttsp_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/input/touchscreen/cyttsp_core.c b/drivers/input/touchscreen/cyttsp_core.c index 8e60437..97ba891 100644 --- a/drivers/input/touchscreen/cyttsp_core.c +++ b/drivers/input/touchscreen/cyttsp_core.c @@ -133,7 +133,7 @@ static int cyttsp_exit_bl_mode(struct cyttsp *ts) memcpy(bl_cmd, bl_command, sizeof(bl_command)); if (ts->pdata->bl_keys) memcpy(&bl_cmd[sizeof(bl_command) - CY_NUM_BL_KEYS], - ts->pdata->bl_keys, sizeof(bl_command)); + ts->pdata->bl_keys, CY_NUM_BL_KEYS); error = ttsp_write_block_data(ts, CY_REG_BASE, sizeof(bl_cmd), bl_cmd); -- 1.7.9.5 This message and any attachments may contain Cypress (or its subsidiaries) confidential information. If it has been received in error, please advise the sender and immediately delete this message.