Skip to content

Commit 20f3cf5

Browse files
jigpuJiri Kosina
authored andcommitted
HID: wacom: Avoid using stale array indicies to read contact count
If we ever see a touch report with contact count data we initialize several variables used to read the contact count in the pre-report phase. These variables are never reset if we process a report which doesn't contain a contact count, however. This can cause the pre- report function to trigger a read of arbitrary memory (e.g. NULL if we're lucky) and potentially crash the driver. This commit restores resetting of the variables back to default "none" values that were used prior to the commit mentioned below. Link: linuxwacom/input-wacom#276 Fixes: 003f50a (HID: wacom: Update last_slot_field during pre_report phase) CC: stable@vger.kernel.org Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com> Reviewed-by: Ping Cheng <ping.cheng@wacom.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
1 parent df03e9b commit 20f3cf5

File tree

1 file changed

+4
-0
lines changed

1 file changed

+4
-0
lines changed

drivers/hid/wacom_wac.c

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2682,6 +2682,10 @@ static void wacom_wac_finger_pre_report(struct hid_device *hdev,
26822682

26832683
hid_data->confidence = true;
26842684

2685+
hid_data->cc_report = 0;
2686+
hid_data->cc_index = -1;
2687+
hid_data->cc_value_index = -1;
2688+
26852689
for (i = 0; i < report->maxfield; i++) {
26862690
struct hid_field *field = report->field[i];
26872691
int j;

0 commit comments

Comments
 (0)