]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait()
authorGeorgiy Osokin <g.osokin@auroraos.dev>
Sun, 17 May 2026 12:06:39 +0000 (15:06 +0300)
committerJiri Kosina <jkosina@suse.com>
Mon, 29 Jun 2026 08:46:13 +0000 (10:46 +0200)
commit0021eb09041f021c079be1022934a280f7f176c0
tree30031cad33e32384dd25e5ebbd0fb183b300fc6f
parent75fe87e19d8aff81eb2c64d15d244ab8da4de945
HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait()

In picolcd_send_and_wait(), an integer overflow of the signed loop counter
'k' can theoretically lead to a NULL pointer dereference of 'raw_data'.
If the loop executes more than INT_MAX times, 'k' becomes negative,
making the condition 'k < size' true even when 'size' is 0.

Change the type of 'k' to 'unsigned int' to prevent the overflow and
eliminate the out-of-bounds access.

Found by Linux Verification Center (linuxtesting.org) with the Svace static
analysis tool.

[jkosina@suse.com: extended hash length]
Fixes: fabdbf2fd22fa17 ("HID: picoLCD: split driver code")
Signed-off-by: Georgiy Osokin <g.osokin@auroraos.dev>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
drivers/hid/hid-picolcd_core.c