If len is 0 or negative when a define_fbtft_write_reg()-generated function is called, len-- underflows to -1, causing the subsequent while (i--) loop to run approximately 2^31 times and write far past the end of buf.
This is a latent bug: nothing in the current code prevents two adjacent negative values in an init_sequence from producing len=0, and there is no guarantee future or out-of-tree panel definitions won't do so. Add an early return for len <= 0, matching the existing guard already present in the sibling function fbtft_write_reg8_bus9(). Reported-by: sashiko-bot <[email protected]> Link: https://sashiko.dev/#/patchset/[email protected]?part=1 Signed-off-by: Anshika Jain <[email protected]> --- drivers/staging/fbtft/fbtft-bus.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/staging/fbtft/fbtft-bus.c b/drivers/staging/fbtft/fbtft-bus.c index e03aa251c..7d7135571 100644 --- a/drivers/staging/fbtft/fbtft-bus.c +++ b/drivers/staging/fbtft/fbtft-bus.c @@ -20,6 +20,9 @@ void func(struct fbtft_par *par, int len, ...) \ int offset = 0; \ buffer_type *buf = (buffer_type *)par->buf; \ \ + if (len <= 0) \ + return; \ + \ if (unlikely(par->debug & DEBUG_WRITE_REGISTER)) { \ va_start(args, len); \ for (i = 0; i < len; i++) { \ -- 2.34.1
