lkml.org 
[lkml]   [2012]   [Mar]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 05/16 v2] Input: atmel_mxt_ts - verify object size in mxt_write_object
    Date
    Don't allow writing past the length of an object.

    Signed-off-by: Daniel Kurtz <djkurtz@chromium.org>
    ---
    drivers/input/touchscreen/atmel_mxt_ts.c | 2 +-
    1 files changed, 1 insertions(+), 1 deletions(-)

    diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c
    index 920b35c..242976d 100644
    --- a/drivers/input/touchscreen/atmel_mxt_ts.c
    +++ b/drivers/input/touchscreen/atmel_mxt_ts.c
    @@ -501,7 +501,7 @@ static int mxt_write_object(struct mxt_data *data,
    u16 reg;

    object = mxt_get_object(data, type);
    - if (!object)
    + if (!object || offset >= object->size)
    return -EINVAL;

    reg = object->start_address;
    --
    1.7.7.3


    \
     
     \ /
      Last update: 2012-03-29 18:55    [W:0.020 / U:92.096 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site