[PATCH] commands: mipi_dbi: fix null pointer dereference when writing data

[PATCH] commands: mipi_dbi: fix null pointer dereference when writing data

[Roland Hieber]

When accessing argv[optind + i], the whole array index must stay below
argc, not only i. Also val is only 4 bytes long, so when indexed with i
(which was initialised to optind, which is at least 3) will overflow
after reading one data argument from the command line. Add a guard
against the latter case, and initialise i to 0 to fix the first problem.

Signed-off-by: Roland Hieber <rhi@pengutronix.de>
---
 commands/mipi_dbi.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/commands/mipi_dbi.c b/commands/mipi_dbi.c
index b9b665b72151..075d08d2ffb5 100644
--- a/commands/mipi_dbi.c
+++ b/commands/mipi_dbi.c
@@ -79,7 +79,12 @@ static int do_mipi_dbi(int argc, char *argv[])
 	if (optind == argc && !write)
 		return mipi_dbi_command_show(dbi, cmd);
 
-	for (i = optind; i < argc; i++) {
+	if (argc > 6) {
+		printf("Error: can only write up to 4 byte at once!\n");
+		return -EOVERFLOW;
+	}
+
+	for (i = 0; i + optind < argc; i++) {
 		ret = kstrtou8(argv[optind + i], 16, &val[i]);
 		if (ret < 0)
 			return ret;
-- 
2.39.2

Re: [PATCH] commands: mipi_dbi: fix null pointer dereference when writing data

[Sascha Hauer]

On Mon, 27 May 2024 15:28:43 +0200, Roland Hieber wrote:
> When accessing argv[optind + i], the whole array index must stay below
> argc, not only i. Also val is only 4 bytes long, so when indexed with i
> (which was initialised to optind, which is at least 3) will overflow
> after reading one data argument from the command line. Add a guard
> against the latter case, and initialise i to 0 to fix the first problem.
> 
> 
> [...]

Applied, thanks!

[1/1] commands: mipi_dbi: fix null pointer dereference when writing data
      https://git.pengutronix.de/cgit/barebox/commit/?id=da602c975fcc (link may not be stable)

Best regards,
-- 
Sascha Hauer <s.hauer@pengutronix.de>