mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2026-07-22 03:27:30 -04:00
Input: ipaq-micro-keys - add length check in micro_key_receive
The driver accesses the message payload (msg[0]) without checking if the length is greater than zero. The parent MFD driver can produce a payload with a length of 0, in which case msg[0] would be uninitialized or stale. Add a check to return early if len is less than 1. Reported-by: sashiko-bot@kernel.org Assisted-by: Antigravity:gemini-3.5-flash Link: https://patch.msgid.link/aintAvTyw4CVb5hG@google.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
This commit is contained in:
@@ -43,6 +43,9 @@ static void micro_key_receive(void *data, int len, unsigned char *msg)
|
||||
struct ipaq_micro_keys *keys = data;
|
||||
int key, down;
|
||||
|
||||
if (len < 1)
|
||||
return;
|
||||
|
||||
down = 0x80 & msg[0];
|
||||
key = 0x7f & msg[0];
|
||||
|
||||
|
||||
Reference in New Issue
Block a user