lkml.org 
[lkml]   [2004]   [Nov]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[PATCH 2.4] I2C updates for 2.4.28 (3/5)
Original report and discussion:
http://marc.theaimsgroup.com/?l=linux-arm-kernel&m=109816546827995&w=2
http://marc.theaimsgroup.com/?l=linux-arm-kernel&m=109926079025024&w=2

Bottom line:
Two hardcoded buffer sizes in i2c_smbus_xfer_emulated (i2c-core) should
depend on I2C_SMBUS_BLOCK_MAX. Else increasing I2C_SMBUS_BLOCK_MAX (in
include/linux/i2c.h) will result in buffer overflows.

Credits go to Tehn Yit Chin for noticing the suspicious hardcoded
values.

Signed-off-by: Jean Delvare <khali@linux-fr.org>

--- linux-2.4.28-rc1/drivers/i2c/i2c-core.c.orig 2004-10-27 23:45:48.000000000 +0200
+++ linux-2.4.28-rc1/drivers/i2c/i2c-core.c 2004-10-29 19:18:09.000000000 +0200
@@ -1098,8 +1098,8 @@
need to use only one message; when reading, we need two. We initialize
most things with sane defaults, to keep the code below somewhat
simpler. */
- unsigned char msgbuf0[34];
- unsigned char msgbuf1[34];
+ unsigned char msgbuf0[I2C_SMBUS_BLOCK_MAX+2];
+ unsigned char msgbuf1[I2C_SMBUS_BLOCK_MAX+2];
int num = read_write == I2C_SMBUS_READ?2:1;
struct i2c_msg msg[2] = { { addr, flags, 1, msgbuf0 },
{ addr, flags | I2C_M_RD, 0, msgbuf1 }

--
Jean Delvare
http://khali.linux-fr.org/
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 14:08    [W:0.130 / U:0.108 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site