Swatantra-66 opened a new pull request, #21315: URL: https://github.com/apache/nuttx/pull/21315
## Summary Fixes #21245 In `drivers/input/st7123.c`, the device capability block read over I2C reports `max_touches`, which was used directly to set `lower.maxpoint`. On each touch interrupt, `st7123_data_worker()` computes `framelen = ST7123_FRAME_HEADER_SIZE + lower->maxpoint * ST7123_TOUCH_AREA_SIZE` and executes a sequential I2C burst read into `dev->frame`. While the header comment at lines 78–81 states: > "The value read back from ST7123_TOUCH_MAX_TOUCHES is clamped to this limit so that a bogus register value can never overrun the frame or sample buffers." `st7123_register()` only checked that `max_touches != 0` and omitted the upper bound check. Since `dev->frame.areas`, `lastx`, `lasty`, and `sample_buf` are all sized to `ST7123_MAX_TOUCH_AREAS` (10), an oversized reported touch count would trigger an out-of-bounds heap write into `dev` and adjacent heap during the I2C frame read. This patch: 1. Implements the promised clamp in `st7123_register()` to ensure `priv->device_caps.max_touches <= ST7123_MAX_TOUCH_AREAS`. 2. Fixes right-brace indentation in `st7123_probe_device()` for full `nxstyle` compliance across the file. ## Impact - Eliminates potential heap out-of-bounds write (CWE-787) when interacting with a malfunctioning or malicious touch controller. - No impact on normal devices reporting $\le 10$ touch points. - No breaking changes or API modifications. ## Testing - Verified with NuttX `tools/nxstyle` (0 errors, 0 warnings). - Static analysis against buffer dimensions (`struct st7123_frame_t`, `lastx`, `lasty`, `sample_buf`). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
