[PATCH 2/7] Input: aiptek: validate macro key indices

[PATCH 2/7] Input: aiptek: validate macro key indices

[Pengpeng Hou]

aiptek_irq() derives macro key indices directly from tablet reports and
then uses them to index macroKeyEvents[]. Report types 4 and 5 use
(data[3] >> 1), while report type 6 reads a 16-bit macro number from the
packet body. None of those indices are checked against the array bounds
before input_report_key() dereferences them.

Reject out-of-range macro indices at each use site so malformed reports
cannot read past macroKeyEvents[].

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
 drivers/input/tablet/aiptek.c | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/drivers/input/tablet/aiptek.c b/drivers/input/tablet/aiptek.c
index 6df24cee3c9d..ab5886a9241d 100644
--- a/drivers/input/tablet/aiptek.c
+++ b/drivers/input/tablet/aiptek.c
@@ -676,12 +676,15 @@ static void aiptek_irq(struct urb *urb)
 			}
 		}
 
-		if (aiptek->lastMacro != -1 && aiptek->lastMacro != macro) {
+		if (aiptek->lastMacro >= 0 &&
+		    aiptek->lastMacro < ARRAY_SIZE(macroKeyEvents) &&
+		    aiptek->lastMacro != macro) {
 		        input_report_key(inputdev, macroKeyEvents[aiptek->lastMacro], 0);
 			aiptek->lastMacro = -1;
 		}
 
-		if (macro != -1 && macro != aiptek->lastMacro) {
+		if (macro >= 0 && macro < ARRAY_SIZE(macroKeyEvents) &&
+		    macro != aiptek->lastMacro) {
 			input_report_key(inputdev, macroKeyEvents[macro], 1);
 			aiptek->lastMacro = macro;
 		}
@@ -715,12 +718,15 @@ static void aiptek_irq(struct urb *urb)
 			}
 		}
 
-		if (aiptek->lastMacro != -1 && aiptek->lastMacro != macro) {
+		if (aiptek->lastMacro >= 0 &&
+		    aiptek->lastMacro < ARRAY_SIZE(macroKeyEvents) &&
+		    aiptek->lastMacro != macro) {
 		        input_report_key(inputdev, macroKeyEvents[aiptek->lastMacro], 0);
 			aiptek->lastMacro = -1;
 		}
 
-		if (macro != -1 && macro != aiptek->lastMacro) {
+		if (macro >= 0 && macro < ARRAY_SIZE(macroKeyEvents) &&
+		    macro != aiptek->lastMacro) {
 			input_report_key(inputdev, macroKeyEvents[macro], 1);
 			aiptek->lastMacro = macro;
 		}
@@ -737,11 +743,11 @@ static void aiptek_irq(struct urb *urb)
 	 */
 	else if (data[0] == 6) {
 		macro = get_unaligned_le16(data + 1);
-		if (macro > 0) {
+		if (macro > 0 && macro - 1 < ARRAY_SIZE(macroKeyEvents)) {
 			input_report_key(inputdev, macroKeyEvents[macro - 1],
 					 0);
 		}
-		if (macro < 25) {
+		if (macro + 1 < ARRAY_SIZE(macroKeyEvents)) {
 			input_report_key(inputdev, macroKeyEvents[macro + 1],
 					 0);
 		}
@@ -760,7 +766,8 @@ static void aiptek_irq(struct urb *urb)
 				aiptek->curSetting.toolMode;
 		}
 
-		input_report_key(inputdev, macroKeyEvents[macro], 1);
+		if (macro < ARRAY_SIZE(macroKeyEvents))
+			input_report_key(inputdev, macroKeyEvents[macro], 1);
 		input_report_abs(inputdev, ABS_MISC,
 				 1 | AIPTEK_REPORT_TOOL_UNKNOWN);
 		input_sync(inputdev);
-- 
2.50.1 (Apple Git-155)

Re: [PATCH 2/7] Input: aiptek: validate macro key indices

[Dmitry Torokhov]

On Mon, Mar 23, 2026 at 03:03:11PM +0800, Pengpeng Hou wrote:
> aiptek_irq() derives macro key indices directly from tablet reports and
> then uses them to index macroKeyEvents[]. Report types 4 and 5 use
> (data[3] >> 1), while report type 6 reads a 16-bit macro number from the
> packet body. None of those indices are checked against the array bounds
> before input_report_key() dereferences them.
> 
> Reject out-of-range macro indices at each use site so malformed reports
> cannot read past macroKeyEvents[].
> 
> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
> ---
>  drivers/input/tablet/aiptek.c | 21 ++++++++++++++-------
>  1 file changed, 14 insertions(+), 7 deletions(-)
> 
> diff --git a/drivers/input/tablet/aiptek.c b/drivers/input/tablet/aiptek.c
> index 6df24cee3c9d..ab5886a9241d 100644
> --- a/drivers/input/tablet/aiptek.c
> +++ b/drivers/input/tablet/aiptek.c
> @@ -676,12 +676,15 @@ static void aiptek_irq(struct urb *urb)
>  			}
>  		}
>  
> -		if (aiptek->lastMacro != -1 && aiptek->lastMacro != macro) {
> +		if (aiptek->lastMacro >= 0 &&
> +		    aiptek->lastMacro < ARRAY_SIZE(macroKeyEvents) &&

I think we do not need to check lastMacro if we make sure that macro is
in correct range.

Thanks.

-- 
Dmitry