github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-23 22:14:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

Input: iqs5xx - validate firmware record destination span

Browse Source 
The firmware record parser checks that the record address starts within
the programmable map, but does not check that the complete record data
fits in that map. A record near the end of the map can therefore make
the copy to pmap exceed its destination span.

Check the record length against the remaining programmable map range
before copying the record data.

Fixes: 7b5bb55d0d ("Input: add support for Azoteq IQS550/572/525")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260715083850.32155-1-pengpeng@iscas.ac.cn
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
This commit is contained in:
Pengpeng Hou 2026-07-15 16:38:50 +08:00 committed by Dmitry Torokhov
parent d6b0c1c2f3
commit 0aa7c205e9
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
drivers/input/touchscreen/iqs5xx.c
View File

@ -785,7 +785,8 @@ static int iqs5xx_fw_file_parse(struct i2c_client *client,
switch (rec_type) {
case IQS5XX_REC_TYPE_DATA:
if (rec_addr < IQS5XX_CHKSM ||
rec_addr > IQS5XX_PMAP_END) {
rec_addr > IQS5XX_PMAP_END ||
rec_len > IQS5XX_PMAP_END + 1 - rec_addr) {
dev_err(&client->dev,
"Invalid address at record %u\n",
rec_num);