Messages in this thread Patch in this message | | | Subject | [PATCH RESEND] mfd: Fix off-by-one value range checking for tps65910_i2c_write | From | Axel Lin <> | Date | Mon, 16 May 2011 22:19:01 +0800 |
| |
If bytes == (TPS65910_MAX_REGISTER + 1), we have a buffer overflow when doing memcpy(&msg[1], src, bytes).
Signed-off-by: Axel Lin <axel.lin@gmail.com> Acked-by: Samuel Ortiz <sameo@linux.intel.com> --- drivers/mfd/tps65910.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/drivers/mfd/tps65910.c b/drivers/mfd/tps65910.c index bf649cf..e318248 100644 --- a/drivers/mfd/tps65910.c +++ b/drivers/mfd/tps65910.c @@ -71,7 +71,7 @@ static int tps65910_i2c_write(struct tps65910 *tps65910, u8 reg, u8 msg[TPS65910_MAX_REGISTER + 1]; int ret; - if (bytes > (TPS65910_MAX_REGISTER + 1)) + if (bytes > TPS65910_MAX_REGISTER) return -EINVAL; msg[0] = reg; -- 1.7.1
| |