.. | .. |
---|
1710 | 1710 | if (length < read_length) |
---|
1711 | 1711 | length = read_length; |
---|
1712 | 1712 | |
---|
1713 | | - if (length + 10 > CY_MAX_INPUT) { |
---|
1714 | | - dev_err(cd->dev, "%s:%d: size=%d is larger than the max %d!!!\n", |
---|
1715 | | - __func__, __LINE__, length + 10, CY_MAX_INPUT); |
---|
1716 | | - return -EINVAL; |
---|
1717 | | - } |
---|
1718 | 1713 | memcpy(read_buf, &cd->response_buf[10], length); |
---|
1719 | 1714 | *crc = get_unaligned_le16(&cd->response_buf[read_length + 10]); |
---|
1720 | 1715 | |
---|
.. | .. |
---|
2486 | 2481 | if (!data_len) |
---|
2487 | 2482 | return -EPROTO; |
---|
2488 | 2483 | |
---|
2489 | | - if (data_len + 8 > CY_MAX_INPUT) { |
---|
2490 | | - dev_err(cd->dev, "%s:%d: size=%d is larger than the max %d!!!\n", |
---|
2491 | | - __func__, __LINE__, data_len, CY_MAX_INPUT); |
---|
2492 | | - return -EINVAL; |
---|
2493 | | - } |
---|
2494 | 2484 | memcpy(return_data, &cd->response_buf[8], data_len); |
---|
2495 | 2485 | |
---|
2496 | 2486 | return 0; |
---|
.. | .. |
---|
3884 | 3874 | tthe_print(cd, cd->input_buf, size, "OpModeData="); |
---|
3885 | 3875 | #endif |
---|
3886 | 3876 | |
---|
3887 | | - if (si->desc.tch_header_size > CY_MAX_INPUT) { |
---|
3888 | | - dev_err(cd->dev, "%s:%d: size=%d is larger than the max %d!!!\n", |
---|
3889 | | - __func__, __LINE__, si->desc.tch_header_size, CY_MAX_INPUT); |
---|
3890 | | - return -EINVAL; |
---|
3891 | | - } |
---|
3892 | | - |
---|
3893 | 3877 | memcpy(si->xy_mode, cd->input_buf, si->desc.tch_header_size); |
---|
3894 | 3878 | cyttsp5_pr_buf(cd->dev, (u8 *)si->xy_mode, si->desc.tch_header_size, |
---|
3895 | 3879 | "xy_mode"); |
---|
.. | .. |
---|
3900 | 3884 | num_cur_tch = max_tch; |
---|
3901 | 3885 | |
---|
3902 | 3886 | length = num_cur_tch * si->desc.tch_record_size; |
---|
3903 | | - |
---|
3904 | | - if ((length + si->desc.tch_header_size) > CY_MAX_INPUT) { |
---|
3905 | | - dev_err(cd->dev, "%s:%d: size=%d is larger than the max %d!!!\n", |
---|
3906 | | - __func__, __LINE__, length + si->desc.tch_header_size, |
---|
3907 | | - CY_MAX_INPUT); |
---|
3908 | | - return -EINVAL; |
---|
3909 | | - } |
---|
3910 | 3887 | |
---|
3911 | 3888 | memcpy(si->xy_data, &cd->input_buf[si->desc.tch_header_size], length); |
---|
3912 | 3889 | cyttsp5_pr_buf(cd->dev, (u8 *)si->xy_data, length, "xy_data"); |
---|
.. | .. |
---|
3954 | 3931 | parade_debug(cd->dev, DEBUG_LEVEL_2, "%s: Received cmd interrupt\n", |
---|
3955 | 3932 | __func__); |
---|
3956 | 3933 | |
---|
3957 | | - if (size > CY_MAX_INPUT) { |
---|
3958 | | - dev_err(cd->dev, "%s:%d: size=%d is larger than the max %d!!!\n", |
---|
3959 | | - __func__, __LINE__, size, CY_MAX_INPUT); |
---|
3960 | | - return -EINVAL; |
---|
3961 | | - } |
---|
3962 | | - |
---|
3963 | 3934 | memcpy(cd->response_buf, cd->input_buf, size); |
---|
3964 | 3935 | |
---|
3965 | 3936 | mutex_lock(&cd->system_lock); |
---|
.. | .. |
---|
4002 | 3973 | wake_up(&cd->wait_q); |
---|
4003 | 3974 | mutex_unlock(&cd->system_lock); |
---|
4004 | 3975 | return 0; |
---|
4005 | | - } else if (size == 2 || size >= CY_PIP_1P7_EMPTY_BUF || size > CY_MAX_INPUT) { |
---|
| 3976 | + } else if (size == 2 || size >= CY_PIP_1P7_EMPTY_BUF) |
---|
4006 | 3977 | /* |
---|
4007 | 3978 | * Before PIP 1.7, empty buffer is 0x0002; |
---|
4008 | 3979 | * From PIP 1.7, empty buffer is 0xFFXX |
---|
4009 | 3980 | */ |
---|
4010 | | - if (size > CY_MAX_INPUT && size < CY_PIP_1P7_EMPTY_BUF) |
---|
4011 | | - dev_err(cd->dev, "%s:%d: size=%d is larger than the max %d!!!\n", |
---|
4012 | | - __func__, __LINE__, size, CY_MAX_INPUT); |
---|
4013 | | - |
---|
4014 | 3981 | return 0; |
---|
4015 | | - } |
---|
4016 | 3982 | |
---|
4017 | 3983 | report_id = cd->input_buf[2]; |
---|
4018 | 3984 | parade_debug(cd->dev, DEBUG_LEVEL_2, "%s: report_id:%X\n", |
---|