This is an automated email from the ASF dual-hosted git repository.
xiaoxiang781216 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/nuttx.git
The following commit(s) were added to refs/heads/master by this push:
new c7bde6363fd drivers/input/st7123: Clamp reported max_touches to
ST7123_MAX_TOUCH_AREAS
c7bde6363fd is described below
commit c7bde6363fd39396965b0a3f9654da38058c19a5
Author: Swatantra Yadav <[email protected]>
AuthorDate: Sat Oct 31 20:05:02 2026 +0530
drivers/input/st7123: Clamp reported max_touches to ST7123_MAX_TOUCH_AREAS
The driver comment at lines 78-81 states:
"The value read back from ST7123_TOUCH_MAX_TOUCHES is clamped to this
limit so that a bogus register value can never overrun the frame or
sample buffers."
However, st7123_register() only checked that max_touches was non-zero
and assigned lower.maxpoint directly without enforcing the upper bound
against ST7123_MAX_TOUCH_AREAS (10). Because dev->frame.areas, lastx,
lasty, and sample_buf are sized to ST7123_MAX_TOUCH_AREAS, an oversized
reported touch count would cause an out-of-bounds heap write during
the sequential I2C frame read in st7123_data_worker().
Implement the promised clamp in st7123_register() and fix right brace
alignment in st7123_probe_device().
Fixes #21245.
Signed-off-by: Swatantra Yadav <[email protected]>
Assisted-by: Google Gemini
---
drivers/input/st7123.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/drivers/input/st7123.c b/drivers/input/st7123.c
index 25b1cefc9dc..1e2e3cdb1e4 100644
--- a/drivers/input/st7123.c
+++ b/drivers/input/st7123.c
@@ -835,7 +835,7 @@ static int st7123_probe_device(struct st7123_dev_t *dev)
{
ierr("failed to read device capabilities: %d", ret);
return -EIO;
- }
+ }
return OK;
}
@@ -959,6 +959,17 @@ int st7123_register(FAR struct i2c_master_s *i2c, uint8_t
minor,
goto errout_with_lock;
}
+ /* Clamp device-reported touches to the supported maximum to prevent
+ * buffer overflow in frame and sample buffers.
+ */
+
+ if (priv->device_caps.max_touches > ST7123_MAX_TOUCH_AREAS)
+ {
+ iwarn("reported touches (%u) exceeds max (%u), clamping\n",
+ priv->device_caps.max_touches, ST7123_MAX_TOUCH_AREAS);
+ priv->device_caps.max_touches = ST7123_MAX_TOUCH_AREAS;
+ }
+
priv->lower.maxpoint = priv->device_caps.max_touches;
priv->lower.xres = ((priv->device_caps.max_x_coord_h << 8) +
priv->device_caps.max_x_coord_l);
