input: touchscreen: synaptics_dsx: Fix buffer overflow

Limit the index to buffer length while copying from
'strptr' to 'firmware_id'.

Change-Id: I1d7cb7a3d9593ca213c7f7341776632e635eb0df
Signed-off-by: Venkata Prahlad Valluru <vvalluru@codeaurora.org>

diff --git a/drivers/input/touchscreen/synaptics_dsx/synaptics_dsx_fw_update.c b/drivers/input/touchscreen/synaptics_dsx/synaptics_dsx_fw_update.c
index 4787f2b..1368013 100644 (file)
--- a/drivers/input/touchscreen/synaptics_dsx/synaptics_dsx_fw_update.c
+++ b/drivers/input/touchscreen/synaptics_dsx/synaptics_dsx_fw_update.c
@@ -681,10 +681,12 @@ static enum flash_area fwu_go_nogo(struct image_header_data *header)
                        goto exit;
                }
 
-               while (strptr[index] >= '0' && strptr[index] <= '9') {
+               while ((index < MAX_FIRMWARE_ID_LEN - 1) && strptr[index] >= '0'
+                                               && strptr[index] <= '9') {
                        firmware_id[index] = strptr[index];
                        index++;
                }
+               firmware_id[index] = '\0';
 
                retval = sstrtoul(firmware_id, 10, &image_fw_id);
                kfree(firmware_id);