Commit 74b634178e5f0e2d8d2d26f308c440687930274b

Authored by Jason Gerecke
Committed by Dmitry Torokhov
1 parent e9fc413f4a

Input: wacom - references to 'wacom->data' should use 'unsigned char*'

'wacom->data' contains raw binary data and can lead to unexpected behavior
if a byte under examination happens to have its MSB set.

Signed-off-by: Jason Gerecke <killertofu@gmail.com>
Tested-by: Aaron Skomra <Aaron.Skomra@wacom.com>
Reviewed-by: Carl Worth <cworth@cworth.org>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Showing 1 changed file with 9 additions and 18 deletions Side-by-side Diff

drivers/input/tablet/wacom_wac.c
... ... @@ -178,10 +178,9 @@
178 178  
179 179 static int wacom_dtu_irq(struct wacom_wac *wacom)
180 180 {
181   - struct wacom_features *features = &wacom->features;
182   - char *data = wacom->data;
  181 + unsigned char *data = wacom->data;
183 182 struct input_dev *input = wacom->input;
184   - int prox = data[1] & 0x20, pressure;
  183 + int prox = data[1] & 0x20;
185 184  
186 185 dev_dbg(input->dev.parent,
187 186 "%s: received report #%d", __func__, data[0]);
... ... @@ -198,10 +197,7 @@
198 197 input_report_key(input, BTN_STYLUS2, data[1] & 0x10);
199 198 input_report_abs(input, ABS_X, le16_to_cpup((__le16 *)&data[2]));
200 199 input_report_abs(input, ABS_Y, le16_to_cpup((__le16 *)&data[4]));
201   - pressure = ((data[7] & 0x01) << 8) | data[6];
202   - if (pressure < 0)
203   - pressure = features->pressure_max + pressure + 1;
204   - input_report_abs(input, ABS_PRESSURE, pressure);
  200 + input_report_abs(input, ABS_PRESSURE, ((data[7] & 0x01) << 8) | data[6]);
205 201 input_report_key(input, BTN_TOUCH, data[1] & 0x05);
206 202 if (!prox) /* out-prox */
207 203 wacom->id[0] = 0;
... ... @@ -906,7 +902,7 @@
906 902 static int wacom_24hdt_irq(struct wacom_wac *wacom)
907 903 {
908 904 struct input_dev *input = wacom->input;
909   - char *data = wacom->data;
  905 + unsigned char *data = wacom->data;
910 906 int i;
911 907 int current_num_contacts = data[61];
912 908 int contacts_to_send = 0;
... ... @@ -959,7 +955,7 @@
959 955 static int wacom_mt_touch(struct wacom_wac *wacom)
960 956 {
961 957 struct input_dev *input = wacom->input;
962   - char *data = wacom->data;
  958 + unsigned char *data = wacom->data;
963 959 int i;
964 960 int current_num_contacts = data[2];
965 961 int contacts_to_send = 0;
... ... @@ -1038,7 +1034,7 @@
1038 1034  
1039 1035 static int wacom_tpc_single_touch(struct wacom_wac *wacom, size_t len)
1040 1036 {
1041   - char *data = wacom->data;
  1037 + unsigned char *data = wacom->data;
1042 1038 struct input_dev *input = wacom->input;
1043 1039 bool prox;
1044 1040 int x = 0, y = 0;
1045 1041  
... ... @@ -1074,10 +1070,8 @@
1074 1070  
1075 1071 static int wacom_tpc_pen(struct wacom_wac *wacom)
1076 1072 {
1077   - struct wacom_features *features = &wacom->features;
1078   - char *data = wacom->data;
  1073 + unsigned char *data = wacom->data;
1079 1074 struct input_dev *input = wacom->input;
1080   - int pressure;
1081 1075 bool prox = data[1] & 0x20;
1082 1076  
1083 1077 if (!wacom->shared->stylus_in_proximity) /* first in prox */
... ... @@ -1093,10 +1087,7 @@
1093 1087 input_report_key(input, BTN_STYLUS2, data[1] & 0x10);
1094 1088 input_report_abs(input, ABS_X, le16_to_cpup((__le16 *)&data[2]));
1095 1089 input_report_abs(input, ABS_Y, le16_to_cpup((__le16 *)&data[4]));
1096   - pressure = ((data[7] & 0x01) << 8) | data[6];
1097   - if (pressure < 0)
1098   - pressure = features->pressure_max + pressure + 1;
1099   - input_report_abs(input, ABS_PRESSURE, pressure);
  1090 + input_report_abs(input, ABS_PRESSURE, ((data[7] & 0x01) << 8) | data[6]);
1100 1091 input_report_key(input, BTN_TOUCH, data[1] & 0x05);
1101 1092 input_report_key(input, wacom->tool[0], prox);
1102 1093 return 1;
... ... @@ -1107,7 +1098,7 @@
1107 1098  
1108 1099 static int wacom_tpc_irq(struct wacom_wac *wacom, size_t len)
1109 1100 {
1110   - char *data = wacom->data;
  1101 + unsigned char *data = wacom->data;
1111 1102  
1112 1103 dev_dbg(wacom->input->dev.parent,
1113 1104 "%s: received report #%d\n", __func__, data[0]);