Re: [PATCH] Input: ims-pcu - bound frame parser write index against read_buf size

[Dmitry Torokhov]

Hi Greg,

On Mon, Apr 20, 2026 at 09:05:31PM +0200, Greg Kroah-Hartman wrote:
> ims_pcu_process_data() implements a STX/DLE/ETX byte-stuffing parser
> that accumulates frame payload into pcu->read_buf[] using the running
> index pcu->read_pos.  read_buf is IMS_PCU_BUF_SIZE (128) bytes and
> read_pos is u8 but of course, we don't check the index before actually
> writing the data :(
> 
> Fix this up by properly rejecting the frame at the first attempt to
> write past read_buf and resync on the next STX, mirroring how the parser
> handles short and bad-checksum frames on ETX.
> 
> Cc: Dmitry Torokhov <dmitry.torokhov@xxxxxxxxx>
> Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver")
> Cc: stable <stable@xxxxxxxxxx>
> Assisted-by: gkh_clanker_t1000
> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>

I already have a patch for this, thanks.

-- 
Dmitry