The checksum loop uses a length byte from the report as the
upper bound. The report buffer is only HY46XX_REPORT_PKT_LEN
bytes.
Fixes: aa2f62cf211a ("Input: add driver for the Hycon HY46XX touchpanel series")
Signed-off-by: Linkai Gong <gonglinkai@kylinos.cn>
---
drivers/input/touchscreen/hycon-hy46xx.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/input/touchscreen/hycon-hy46xx.c b/drivers/input/touchscreen/hycon-hy46xx.c
index 1513f20cbf51..bb8b82b11301 100644
--- a/drivers/input/touchscreen/hycon-hy46xx.c
+++ b/drivers/input/touchscreen/hycon-hy46xx.c
@@ -84,7 +84,7 @@ static bool hycon_hy46xx_check_checksum(struct hycon_hy46xx_data *tsdata, u8 *bu
u8 chksum = 0;
int i;
- for (i = 2; i < buf[HY46XX_CHKSUM_LEN]; i++)
+ for (i = 2; i < min_t(int, buf[HY46XX_CHKSUM_LEN], HY46XX_REPORT_PKT_LEN); i++)
chksum += buf[i];
if (chksum == buf[HY46XX_CHKSUM_CODE])
--
2.25.1