touch/focaltech: check finger count to avoid invalid access.

Bug: 240000163
Test: pass to run following test:
adb shell cat /proc/focaltech_touch/selftest/Strength

Signed-off-by: Mason Wang <masonwang@google.com>
Change-Id: Ic855ecefd5c3a901cb181612a8eac5380edc0e0c

2 files changed, 22 insertions, 15 deletions

diff --git a/ft3658/focaltech_common.h b/ft3658/focaltech_common.h
index be4583f..ffa9da1 100644
--- a/ft3658/focaltech_common.h
+++ b/ft3658/focaltech_common.h
@@ -146,7 +146,7 @@
                                                     // bit 7   : LPWG
 #define FTS_CAP_DATA_LEN                    91
 #define FTS_SELF_DATA_LEN                   68
-#define FTS_FULL_HEATMAP_RAW_SIZE(tx_num, rx_num) \
+#define FTS_FULL_TOUCH_RAW_SIZE(tx_num, rx_num) \
     (FTS_CAP_DATA_LEN + ((tx_num) * (rx_num) + FTS_SELF_DATA_LEN * 2) * sizeof(u16))
 #define FTS_PRESSURE_SCALE                  85      // 255 / 3
 #define FTS_CUSTOMER_STATUS_LEN             4
diff --git a/ft3658/focaltech_test/focaltech_test.c b/ft3658/focaltech_test/focaltech_test.c
index c2f3c15..14c8f5c 100644
--- a/ft3658/focaltech_test/focaltech_test.c
+++ b/ft3658/focaltech_test/focaltech_test.c
@@ -2855,9 +2855,10 @@ static int proc_test_strength_show(struct seq_file *s, void *v)
     u8 *trans_raw = NULL;
     int base_raw_size = 0;
     int base = 0;
-    int fast_events_x = 0;
-    int fast_events_y = 0;
-    u8 fast_events_id = 0;
+    u8 tp_finger_cnt = 0;
+    int tp_events_x = 0;
+    int tp_events_y = 0;
+    u8 tp_events_id = 0;
 
     fts_ts_set_bus_ref(ts_data, FTS_TS_BUS_REF_SYSFS, true);
     ret = enter_work_mode();
@@ -2868,8 +2869,8 @@ static int proc_test_strength_show(struct seq_file *s, void *v)
     node_num = tx * rx;
     self_node = tx + rx;
 
-    base_raw_size = FTS_FULL_HEATMAP_RAW_SIZE(tx, rx);
-    FTS_DEBUG("heapmap base_raw size = %d", base_raw_size);
+    base_raw_size = FTS_FULL_TOUCH_RAW_SIZE(tx, rx);
+    FTS_DEBUG("base_raw size = %d", base_raw_size);
     base_raw = fts_malloc(base_raw_size);
     if (!base_raw) {
         FTS_ERROR("malloc memory for raw fails");
@@ -2891,17 +2892,23 @@ static int proc_test_strength_show(struct seq_file *s, void *v)
         goto exit;
     }
 
+    tp_finger_cnt = base_raw[1];
+    if (tp_finger_cnt > FTS_MAX_POINTS_SUPPORT) {
+        FTS_ERROR("The finger count(%d) is over than max fingers(%d)",
+            tp_finger_cnt, FTS_MAX_POINTS_SUPPORT);
+        tp_finger_cnt = FTS_MAX_POINTS_SUPPORT;
+    }
+
     /*---------Output touch point-----------*/
-    for (i = 0; i < base_raw[1]; i++) {
+    for (i = 0; i < tp_finger_cnt; i++) {
          base = FTS_ONE_TCH_LEN * i;
-
-         fast_events_x = ((base_raw[2 + base] & 0x0F) << 8) +
-                          (base_raw[3 + base] & 0xFF);
-         fast_events_y = ((base_raw[4 + base] & 0x0F) << 8) +
-                          (base_raw[5 + base] & 0xFF);
-         fast_events_id = (base_raw[4 + base] & 0xF0) >> 4;
-         seq_printf(s, "Finger ID = %d , x = %d, y = %d\n", fast_events_id,
-                    fast_events_x, fast_events_y);
+         tp_events_x = ((base_raw[2 + base] & 0x0F) << 8) +
+                       (base_raw[3 + base] & 0xFF);
+         tp_events_y = ((base_raw[4 + base] & 0x0F) << 8) +
+                       (base_raw[5 + base] & 0xFF);
+         tp_events_id = (base_raw[4 + base] & 0xF0) >> 4;
+         seq_printf(s, "Finger ID = %d, x = %d, y = %d\n", tp_events_id,
+                    tp_events_x, tp_events_y);
     }
 
     seq_printf(s, "     ");