diff options
| author | Richard Davies <richard@arachsys.com> | 2026-08-02 17:53:10 -0700 |
|---|---|---|
| committer | Dmitry Torokhov <dmitry.torokhov@gmail.com> | 2026-08-02 18:20:24 -0700 |
| commit | 296736076b3fd078742651c719555a488624023a (patch) | |
| tree | 5c5373fff258009897edad4e7d739fc14d8a807e /tools/perf/scripts/python/bin | |
| parent | 410c44b1096789d0c40fbee706520e981dba7bc1 (diff) | |
Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet
Make finger2 (and also finger1) unsigned, so that if the finger index in
the packet is 0 then subtracting 1 creates an array index which overflows
above the existing check for FOC_MAX_FINGERS, as the existing comment says
it should, instead of writing to state->fingers[-1].
Fixes: 05be1d079ec0 ("Input: psmouse - support for the FocalTech PS/2 protocol extensions")
Signed-off-by: Richard Davies <richard@arachsys.com>
Link: https://patch.msgid.link/20260701190932.14960-1-richard@arachsys.com
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Diffstat (limited to 'tools/perf/scripts/python/bin')
0 files changed, 0 insertions, 0 deletions