| Subject | Re: [PATCH 3.19.y-ckt 016/130] Input: zforce - don't overwrite the stack | From | Dmitry Torokhov <> | Date | Thu, 27 Aug 2015 15:24:10 -0700 |
| |
On August 27, 2015 3:10:07 PM PDT, Kamal Mostafa <kamal@canonical.com> wrote: >3.19.8-ckt6 -stable review patch. If anyone has any objections, please >let me know.
Bad patch, reverted in mainline, please drop.
> >------------------ > >From: Oleksij Rempel <external.Oleksij.Rempel@de.bosch.com> > >commit 7d01cd261c76f95913c81554a751968a1d282d3a upstream. > >If we get a corrupted packet with PAYLOAD_LENGTH > FRAME_MAXSIZE, we >will silently overwrite the stack. > >Signed-off-by: Oleksij Rempel <external.Oleksij.Rempel@de.bosch.com> >Signed-off-by: Dirk Behme <dirk.behme@de.bosch.com> >Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> >Signed-off-by: Kamal Mostafa <kamal@canonical.com> >--- > drivers/input/touchscreen/zforce_ts.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > >diff --git a/drivers/input/touchscreen/zforce_ts.c >b/drivers/input/touchscreen/zforce_ts.c >index 19880c7..a9e1ee3 100644 >--- a/drivers/input/touchscreen/zforce_ts.c >+++ b/drivers/input/touchscreen/zforce_ts.c >@@ -430,7 +430,7 @@ static int zforce_read_packet(struct zforce_ts *ts, >u8 *buf) > goto unlock; > } > >- if (buf[PAYLOAD_LENGTH] == 0) { >+ if (buf[PAYLOAD_LENGTH] == 0 || buf[PAYLOAD_LENGTH] > FRAME_MAXSIZE) >{ > dev_err(&client->dev, "invalid payload length: %d\n", > buf[PAYLOAD_LENGTH]); > ret = -EIO;
Thanks.
-- Dmitry
|