[PATCH 2/7] Input: aiptek: validate macro key indices

[Pengpeng Hou]

aiptek_irq() derives macro key indices directly from tablet reports and
then uses them to index macroKeyEvents[]. Report types 4 and 5 use
(data[3] >> 1), while report type 6 reads a 16-bit macro number from the
packet body. None of those indices are checked against the array bounds
before input_report_key() dereferences them.

Reject out-of-range macro indices at each use site so malformed reports
cannot read past macroKeyEvents[].

Signed-off-by: Pengpeng Hou <pengpeng@xxxxxxxxxxx>
---
 drivers/input/tablet/aiptek.c | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/drivers/input/tablet/aiptek.c b/drivers/input/tablet/aiptek.c
index 6df24cee3c9d..ab5886a9241d 100644
--- a/drivers/input/tablet/aiptek.c
+++ b/drivers/input/tablet/aiptek.c
@@ -676,12 +676,15 @@ static void aiptek_irq(struct urb *urb)
 			}
 		}
 
-		if (aiptek->lastMacro != -1 && aiptek->lastMacro != macro) {
+		if (aiptek->lastMacro >= 0 &&
+		    aiptek->lastMacro < ARRAY_SIZE(macroKeyEvents) &&
+		    aiptek->lastMacro != macro) {
 		        input_report_key(inputdev, macroKeyEvents[aiptek->lastMacro], 0);
 			aiptek->lastMacro = -1;
 		}
 
-		if (macro != -1 && macro != aiptek->lastMacro) {
+		if (macro >= 0 && macro < ARRAY_SIZE(macroKeyEvents) &&
+		    macro != aiptek->lastMacro) {
 			input_report_key(inputdev, macroKeyEvents[macro], 1);
 			aiptek->lastMacro = macro;
 		}
@@ -715,12 +718,15 @@ static void aiptek_irq(struct urb *urb)
 			}
 		}
 
-		if (aiptek->lastMacro != -1 && aiptek->lastMacro != macro) {
+		if (aiptek->lastMacro >= 0 &&
+		    aiptek->lastMacro < ARRAY_SIZE(macroKeyEvents) &&
+		    aiptek->lastMacro != macro) {
 		        input_report_key(inputdev, macroKeyEvents[aiptek->lastMacro], 0);
 			aiptek->lastMacro = -1;
 		}
 
-		if (macro != -1 && macro != aiptek->lastMacro) {
+		if (macro >= 0 && macro < ARRAY_SIZE(macroKeyEvents) &&
+		    macro != aiptek->lastMacro) {
 			input_report_key(inputdev, macroKeyEvents[macro], 1);
 			aiptek->lastMacro = macro;
 		}
@@ -737,11 +743,11 @@ static void aiptek_irq(struct urb *urb)
 	 */
 	else if (data[0] == 6) {
 		macro = get_unaligned_le16(data + 1);
-		if (macro > 0) {
+		if (macro > 0 && macro - 1 < ARRAY_SIZE(macroKeyEvents)) {
 			input_report_key(inputdev, macroKeyEvents[macro - 1],
 					 0);
 		}
-		if (macro < 25) {
+		if (macro + 1 < ARRAY_SIZE(macroKeyEvents)) {
 			input_report_key(inputdev, macroKeyEvents[macro + 1],
 					 0);
 		}
@@ -760,7 +766,8 @@ static void aiptek_irq(struct urb *urb)
 				aiptek->curSetting.toolMode;
 		}
 
-		input_report_key(inputdev, macroKeyEvents[macro], 1);
+		if (macro < ARRAY_SIZE(macroKeyEvents))
+			input_report_key(inputdev, macroKeyEvents[macro], 1);
 		input_report_abs(inputdev, ABS_MISC,
 				 1 | AIPTEK_REPORT_TOOL_UNKNOWN);
 		input_sync(inputdev);
-- 
2.50.1 (Apple Git-155)