[PATCH] Input: exc3000 - zero-initialize vendor response buffers

[PATCH] Input: exc3000 - zero-initialize vendor response buffers

[Edson Bruno]

exc3000_vendor_data_request() copies up to EXC3000_LEN_FRAME - 1 bytes
of device-supplied data into the caller's buffer and returns the length
reported by the device. The callers (the fw_version, model and type
sysfs attributes, and probe) pass uninitialized stack buffers and do
not check that length.

If the device returns a short reply, fw_version_show() tests and prints
response[2] and response[3] uninitialized. If the reply is not NUL
terminated, the "%s" conversions read past the copied data into
uninitialized stack, which is then exposed via the world-readable
sysfs attributes.

Zero-initialize the buffers. At most EXC3000_LEN_FRAME - 1 bytes are
ever copied, so the last byte stays zero and the strings are always
terminated.

The problem was found while reviewing the driver with an LLM assistant,
which also helped draft this changelog.

Fixes: d862a3068ea5 ("Input: exc3000 - add support to query model and fw_version")
Assisted-by: Claude:claude-sonnet-5-5
Signed-off-by: Edson Bruno <cloudflare.ddos21@gmail.com>
---
 drivers/input/touchscreen/exc3000.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/input/touchscreen/exc3000.c b/drivers/input/touchscreen/exc3000.c
index 037bb35238a3..40d74f6deeb8 100644
--- a/drivers/input/touchscreen/exc3000.c
+++ b/drivers/input/touchscreen/exc3000.c
@@ -262,7 +262,7 @@ static ssize_t fw_version_show(struct device *dev,
 {
 	struct i2c_client *client = to_i2c_client(dev);
 	struct exc3000_data *data = i2c_get_clientdata(client);
-	u8 response[EXC3000_LEN_FRAME];
+	u8 response[EXC3000_LEN_FRAME] = {};
 	int ret;
 
 	/* query bootloader info */
@@ -292,7 +292,7 @@ static ssize_t model_show(struct device *dev,
 {
 	struct i2c_client *client = to_i2c_client(dev);
 	struct exc3000_data *data = i2c_get_clientdata(client);
-	u8 response[EXC3000_LEN_FRAME];
+	u8 response[EXC3000_LEN_FRAME] = {};
 	int ret;
 
 	ret = exc3000_vendor_data_request(data, (u8[]){'E'}, 1, response, 1);
@@ -308,7 +308,7 @@ static ssize_t type_show(struct device *dev,
 {
 	struct i2c_client *client = to_i2c_client(dev);
 	struct exc3000_data *data = i2c_get_clientdata(client);
-	u8 response[EXC3000_LEN_FRAME];
+	u8 response[EXC3000_LEN_FRAME] = {};
 	int ret;
 
 	ret = exc3000_vendor_data_request(data, (u8[]){'F'}, 1, response, 1);
@@ -410,7 +410,7 @@ static int exc3000_probe(struct i2c_client *client)
 	 * or two touch events anyways).
 	 */
 	for (retry = 0; retry < 3; retry++) {
-		u8 response[EXC3000_LEN_FRAME];
+		u8 response[EXC3000_LEN_FRAME] = {};
 
 		error = exc3000_vendor_data_request(data, (u8[]){'E'}, 1,
 						    response, 1);
-- 
2.53.0