diff options
| author | davidycchen <davidycchen@google.com> | 2022-04-01 13:13:41 +0800 |
|---|---|---|
| committer | davidycchen <davidycchen@google.com> | 2022-04-01 13:32:28 +0800 |
| commit | d2e79c305280f59f613d4d7c981688aeb9aa9850 (patch) | |
| tree | c3b00491e06ff67aa9e284b2b4060ca7f83f76db | |
| parent | c152c209831eac247f060d1d16d16ec95d2530ee (diff) | |
| download | synaptics_touch-d2e79c305280f59f613d4d7c981688aeb9aa9850.tar.gz | |
synaptics: fix invalid-access in syna_populate_frame
Bug: 227697090
Test: Build KASAN and flash kernel image.
Signed-off-by: davidycchen <davidycchen@google.com>
Change-Id: I73db27671a65f3218ca4382b66afc02fca306a53
| -rw-r--r-- | syna_tcm2.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/syna_tcm2.c b/syna_tcm2.c index 2eb01ac..30eb9c2 100644 --- a/syna_tcm2.c +++ b/syna_tcm2.c @@ -1060,6 +1060,7 @@ static int syna_dev_ptflib_decoder(struct syna_tcm *tcm, const u16 *in_array, int out_array_size = 0; u16 prev_word = 0; u16 repetition = 0; + u16 *temp_out_array = out_array; for (i = 0; i < in_array_size; i++) { u16 curr_word = in_array[i]; @@ -1068,13 +1069,13 @@ static int syna_dev_ptflib_decoder(struct syna_tcm *tcm, const u16 *in_array, if (out_array_size + repetition > out_array_max_size) break; for (j = 0; j < repetition; j++) { - *out_array++ = prev_word; + *temp_out_array++ = prev_word; out_array_size++; } } else { if (out_array_size >= out_array_max_size) break; - *out_array++ = curr_word; + *temp_out_array++ = curr_word; out_array_size++; prev_word = curr_word; } |