[PATCH] Input: cyapa_gen3 - clamp the reported finger count to the array

[Guanglei Zhu]

The finger count is taken from the top nibble of a status byte the
trackpad firmware fills in, and used to walk the touch array:

	num_fingers = (data->finger_btn >> 4) & 0x0f;
	for (i = 0; i < num_fingers; i++) {
		const struct cyapa_touch *touch = &data->touches[i];

The nibble allows up to fifteen fingers, but the array holds the
five touches the chip is documented to report, so a firmware that
counts beyond that makes the driver report coordinates read from
the stack past the register block.

Clamp the finger count to the size of the array.

Fixes: 9f1cd857518f ("Input: cyapa - re-design driver to support multi-trackpad in one driver")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Guanglei Zhu <zhugl3@xxxxxxxxxxxx>
---
 drivers/input/mouse/cyapa_gen3.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/input/mouse/cyapa_gen3.c b/drivers/input/mouse/cyapa_gen3.c
index fc3fb954523b..fda807a4c141 100644
--- a/drivers/input/mouse/cyapa_gen3.c
+++ b/drivers/input/mouse/cyapa_gen3.c
@@ -1149,7 +1149,8 @@ static int cyapa_gen3_event_process(struct cyapa *cyapa,
 	int num_fingers;
 	int i;
 
-	num_fingers = (data->finger_btn >> 4) & 0x0f;
+	num_fingers = min((data->finger_btn >> 4) & 0x0f,
+			  ARRAY_SIZE(data->touches));
 	for (i = 0; i < num_fingers; i++) {
 		const struct cyapa_touch *touch = &data->touches[i];
 		/* Note: touch->id range is 1 to 15; slots are 0 to 14. */
-- 
2.50.1