p71924506
/
linux_old1
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

staging: fbtft: array underflow in fbtft_request_gpios_match() 

"val" can be negative, so we'd write before the start of the
par->gpio.db[] array.

Fixes: c296d5f995 ("staging: fbtft: core support")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Dan Carpenter 2017-07-18 12:30:10 +03:00 committed by Greg Kroah-Hartman
parent c2d79b4b6d
commit 0d0d4d21a0
1 changed files with 2 additions and 2 deletions
drivers/staging/fbtft
fbtft-core.c

4
drivers/staging/fbtft/fbtft-core.c
View File

@ -84,7 +84,7 @@ static unsigned long fbtft_request_gpios_match(struct fbtft_par *par,
const struct fbtft_gpio *gpio) const struct fbtft_gpio *gpio)
{ {
int ret; int ret;
long val; unsigned int val;
fbtft_par_dbg(DEBUG_REQUEST_GPIOS_MATCH, par, "%s('%s')\n", fbtft_par_dbg(DEBUG_REQUEST_GPIOS_MATCH, par, "%s('%s')\n",
__func__, gpio->name); __func__, gpio->name);
@ -108,7 +108,7 @@ static unsigned long fbtft_request_gpios_match(struct fbtft_par *par,
par->gpio.latch = gpio->gpio; par->gpio.latch = gpio->gpio;
return GPIOF_OUT_INIT_LOW; return GPIOF_OUT_INIT_LOW;
} else if (gpio->name[0] == 'd' && gpio->name[1] == 'b') { } else if (gpio->name[0] == 'd' && gpio->name[1] == 'b') {
ret = kstrtol(&gpio->name[2], 10, &val); ret = kstrtouint(&gpio->name[2], 10, &val);
if (ret == 0 && val < 16) { if (ret == 0 && val < 16) {
par->gpio.db[val] = gpio->gpio; par->gpio.db[val] = gpio->gpio;
return GPIOF_OUT_INIT_LOW; return GPIOF_OUT_INIT_LOW;