When accessing argv[optind + i], the whole array index must stay below argc, not only i. Also val is only 4 bytes long, so when indexed with i (which was initialised to optind, which is at least 3) will overflow after reading one data argument from the command line. Add a guard against the latter case, and initialise i to 0 to fix the first problem.
Signed-off-by: Roland Hieber <[email protected]> --- commands/mipi_dbi.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/commands/mipi_dbi.c b/commands/mipi_dbi.c index b9b665b72151..075d08d2ffb5 100644 --- a/commands/mipi_dbi.c +++ b/commands/mipi_dbi.c @@ -79,7 +79,12 @@ static int do_mipi_dbi(int argc, char *argv[]) if (optind == argc && !write) return mipi_dbi_command_show(dbi, cmd); - for (i = optind; i < argc; i++) { + if (argc > 6) { + printf("Error: can only write up to 4 byte at once!\n"); + return -EOVERFLOW; + } + + for (i = 0; i + optind < argc; i++) { ret = kstrtou8(argv[optind + i], 16, &val[i]); if (ret < 0) return ret; -- 2.39.2
