lkml.org 
[lkml]   [2012]   [Mar]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH 03/20] Input: atmel_mxt_ts - verify object size in mxt_write_object
    On 03/14/2012 10:33 AM, Joonyoung Shim wrote:
    > On 03/13/2012 09:04 PM, Daniel Kurtz wrote:
    >> Don't allow writing past the length of an object.
    >>
    >> Signed-off-by: Daniel Kurtz<djkurtz@chromium.org>
    >> ---
    >> drivers/input/touchscreen/atmel_mxt_ts.c | 2 +-
    >> 1 files changed, 1 insertions(+), 1 deletions(-)
    >>
    >> diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c
    >> b/drivers/input/touchscreen/atmel_mxt_ts.c
    >> index 0d4d492..e18c698 100644
    >> --- a/drivers/input/touchscreen/atmel_mxt_ts.c
    >> +++ b/drivers/input/touchscreen/atmel_mxt_ts.c
    >> @@ -506,7 +506,7 @@ static int mxt_write_object(struct mxt_data *data,
    >> u16 reg;
    >>
    >> object = mxt_get_object(data, type);
    >> - if (!object)
    >> + if (!object || offset>= object->size)
    >
    > The object->size is actual object size - 1.
    >
    > + if (!object || offset> object->size)
    >

    OK. another patch covers this.

    >
    >> return -EINVAL;
    >>
    >> reg = object->start_address;
    >



    \
     
     \ /
      Last update: 2012-03-14 03:39    [W:6.752 / U:0.036 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site