[PATCH] Input: ims-pcu - bound frame parser write index against read_buf size

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

ims_pcu_process_data() implements a STX/DLE/ETX byte-stuffing parser
that accumulates frame payload into pcu->read_buf[] using the running
index pcu->read_pos.  read_buf is IMS_PCU_BUF_SIZE (128) bytes and
read_pos is u8 but of course, we don't check the index before actually
writing the data :(

Fix this up by properly rejecting the frame at the first attempt to
write past read_buf and resync on the next STX, mirroring how the parser
handles short and bad-checksum frames on ETX.

Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver")
Cc: stable <stable@kernel.org>
Assisted-by: gkh_clanker_t1000
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/input/misc/ims-pcu.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/drivers/input/misc/ims-pcu.c b/drivers/input/misc/ims-pcu.c
index f69de9762c4e..87c66483b493 100644
--- a/drivers/input/misc/ims-pcu.c
+++ b/drivers/input/misc/ims-pcu.c
@@ -451,6 +451,8 @@ static void ims_pcu_process_data(struct ims_pcu *pcu, struct urb *urb)
 
 		if (pcu->have_dle) {
 			pcu->have_dle = false;
+			if (pcu->read_pos >= IMS_PCU_BUF_SIZE)
+				goto frame_overflow;
 			pcu->read_buf[pcu->read_pos++] = data;
 			pcu->check_sum += data;
 			continue;
@@ -491,10 +493,19 @@ static void ims_pcu_process_data(struct ims_pcu *pcu, struct urb *urb)
 			break;
 
 		default:
+			if (pcu->read_pos >= IMS_PCU_BUF_SIZE)
+				goto frame_overflow;
 			pcu->read_buf[pcu->read_pos++] = data;
 			pcu->check_sum += data;
 			break;
 		}
+		continue;
+
+frame_overflow:
+		dev_warn(pcu->dev, "Frame longer than %d bytes, discarding\n", IMS_PCU_BUF_SIZE);
+		pcu->have_stx = false;
+		pcu->have_dle = false;
+		pcu->read_pos = 0;
 	}
 }
 
-- 
2.53.0