Re: [PATCH 2/7] Input: aiptek: validate macro key indices

[Dmitry Torokhov]

On Mon, Mar 23, 2026 at 03:03:11PM +0800, Pengpeng Hou wrote:
> aiptek_irq() derives macro key indices directly from tablet reports and
> then uses them to index macroKeyEvents[]. Report types 4 and 5 use
> (data[3] >> 1), while report type 6 reads a 16-bit macro number from the
> packet body. None of those indices are checked against the array bounds
> before input_report_key() dereferences them.
> 
> Reject out-of-range macro indices at each use site so malformed reports
> cannot read past macroKeyEvents[].
> 
> Signed-off-by: Pengpeng Hou <pengpeng@xxxxxxxxxxx>
> ---
>  drivers/input/tablet/aiptek.c | 21 ++++++++++++++-------
>  1 file changed, 14 insertions(+), 7 deletions(-)
> 
> diff --git a/drivers/input/tablet/aiptek.c b/drivers/input/tablet/aiptek.c
> index 6df24cee3c9d..ab5886a9241d 100644
> --- a/drivers/input/tablet/aiptek.c
> +++ b/drivers/input/tablet/aiptek.c
> @@ -676,12 +676,15 @@ static void aiptek_irq(struct urb *urb)
>  			}
>  		}
>  
> -		if (aiptek->lastMacro != -1 && aiptek->lastMacro != macro) {
> +		if (aiptek->lastMacro >= 0 &&
> +		    aiptek->lastMacro < ARRAY_SIZE(macroKeyEvents) &&

I think we do not need to check lastMacro if we make sure that macro is
in correct range.

Thanks.

-- 
Dmitry