When accessing argv[optind + i], the whole array index must stay below
argc, not only i. Also val is only 4 bytes long, so when indexed with i
(which was initialised to optind, which is at least 3) will overflow
after reading one data argument from the command line. Add a guard
against the latter case, and initialise i to 0 to fix the first problem.
Signed-off-by: Roland Hieber <rhi@xxxxxxxxxxxxxx>
---
commands/mipi_dbi.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/commands/mipi_dbi.c b/commands/mipi_dbi.c
index b9b665b72151..075d08d2ffb5 100644
--- a/commands/mipi_dbi.c
+++ b/commands/mipi_dbi.c
@@ -79,7 +79,12 @@ static int do_mipi_dbi(int argc, char *argv[])
if (optind == argc && !write)
return mipi_dbi_command_show(dbi, cmd);
- for (i = optind; i < argc; i++) {
+ if (argc > 6) {
+ printf("Error: can only write up to 4 byte at once!\n");
+ return -EOVERFLOW;
+ }
+
+ for (i = 0; i + optind < argc; i++) {
ret = kstrtou8(argv[optind + i], 16, &val[i]);
if (ret < 0)
return ret;
--
2.39.2
