* [PATCH] Input: zforce - don't overwrite the stack
@ 2015-07-13 12:45 Dirk Behme
2015-07-13 17:02 ` Dmitry Torokhov
0 siblings, 1 reply; 2+ messages in thread
From: Dirk Behme @ 2015-07-13 12:45 UTC (permalink / raw)
To: linux-input; +Cc: dmitry.torokhov, Oleksij Rempel, Dirk Behme
From: Oleksij Rempel <external.Oleksij.Rempel@de.bosch.com>
If we get a corrupted packet with PAYLOAD_LENGTH > FRAME_MAXSIZE, we
will silently overwrite the stack.
Signed-off-by: Oleksij Rempel <external.Oleksij.Rempel@de.bosch.com>
Signed-off-by: Dirk Behme <dirk.behme@de.bosch.com>
---
drivers/input/touchscreen/zforce_ts.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/input/touchscreen/zforce_ts.c b/drivers/input/touchscreen/zforce_ts.c
index c4cffcf..32749db 100644
--- a/drivers/input/touchscreen/zforce_ts.c
+++ b/drivers/input/touchscreen/zforce_ts.c
@@ -441,7 +441,7 @@ static int zforce_read_packet(struct zforce_ts *ts, u8 *buf)
goto unlock;
}
- if (buf[PAYLOAD_LENGTH] == 0) {
+ if (buf[PAYLOAD_LENGTH] == 0 || buf[PAYLOAD_LENGTH] > FRAME_MAXSIZE) {
dev_err(&client->dev, "invalid payload length: %d\n",
buf[PAYLOAD_LENGTH]);
ret = -EIO;
--
2.3.4
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] Input: zforce - don't overwrite the stack
2015-07-13 12:45 [PATCH] Input: zforce - don't overwrite the stack Dirk Behme
@ 2015-07-13 17:02 ` Dmitry Torokhov
0 siblings, 0 replies; 2+ messages in thread
From: Dmitry Torokhov @ 2015-07-13 17:02 UTC (permalink / raw)
To: Dirk Behme; +Cc: linux-input, Oleksij Rempel
On Mon, Jul 13, 2015 at 02:45:12PM +0200, Dirk Behme wrote:
> From: Oleksij Rempel <external.Oleksij.Rempel@de.bosch.com>
>
> If we get a corrupted packet with PAYLOAD_LENGTH > FRAME_MAXSIZE, we
> will silently overwrite the stack.
>
> Signed-off-by: Oleksij Rempel <external.Oleksij.Rempel@de.bosch.com>
> Signed-off-by: Dirk Behme <dirk.behme@de.bosch.com>
Applied, thank you.
> ---
> drivers/input/touchscreen/zforce_ts.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/input/touchscreen/zforce_ts.c b/drivers/input/touchscreen/zforce_ts.c
> index c4cffcf..32749db 100644
> --- a/drivers/input/touchscreen/zforce_ts.c
> +++ b/drivers/input/touchscreen/zforce_ts.c
> @@ -441,7 +441,7 @@ static int zforce_read_packet(struct zforce_ts *ts, u8 *buf)
> goto unlock;
> }
>
> - if (buf[PAYLOAD_LENGTH] == 0) {
> + if (buf[PAYLOAD_LENGTH] == 0 || buf[PAYLOAD_LENGTH] > FRAME_MAXSIZE) {
> dev_err(&client->dev, "invalid payload length: %d\n",
> buf[PAYLOAD_LENGTH]);
> ret = -EIO;
> --
> 2.3.4
>
--
Dmitry
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2015-07-13 17:02 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2015-07-13 12:45 [PATCH] Input: zforce - don't overwrite the stack Dirk Behme
2015-07-13 17:02 ` Dmitry Torokhov
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).