Skip to contentSkip to conversation

mfd: Fix off-by-one value range checking for tps65912_i2c_write

PATCH In review Axel Lin 2 participants 2 messages Jun 24, 2011 – Jul 4, 2011 Multifunction devices (MFD)

lore
Share & tools
lore

Axel Lin

author
#0 lore raw

PATCH 1/1 mfd: Fix off-by-one value range checking for tps65912_i2c_write

Quoted 1 line

From c5124060f13296bfc8cbbbb8298cf4b9b1faa1e9 Mon Sep 17 00:00:00 2001

From: Axel Lin <[email protected]>
Date: Fri, 24 Jun 2011 15:34:16 +0800
Subject: [PATCH] mfd: Fix off-by-one value range checking for tps65912_i2c_write

If bytes == (TPS6591X_MAX_REGISTER + 1), we have a buffer overflow when doing memcpy(&msg[1], src, bytes).

Signed-off-by Axel Lin <[email protected]>
---
 drivers/mfd/tps65912-i2c.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)
drivers/mfd/tps65912-i2c.c +1 -1
index 9ed123a..c041f2c 100644
@@ -57,7 +57,7 @@ static int tps65912_i2c_write(struct tps65912 *tps65912, u8 reg,
 	u8 msg[TPS6591X_MAX_REGISTER + 1];
 	int ret;
 
-	if (bytes > (TPS6591X_MAX_REGISTER + 1))
+	if (bytes > TPS6591X_MAX_REGISTER)
 		return -EINVAL;
 
 	msg[0] = reg;
Signature · 1 line
1.7.4.1
#1 lore raw

Hi Axel,

Quoted 7 lines · Axel Lin

From c5124060f13296bfc8cbbbb8298cf4b9b1faa1e9 Mon Sep 17 00:00:00 2001
From: Axel Lin <[email protected]>
Date: Fri, 24 Jun 2011 15:34:16 +0800
Subject: [PATCH] mfd: Fix off-by-one value range checking for tps65912_i2c_write

If bytes == (TPS6591X_MAX_REGISTER + 1), we have a buffer overflow when doing memcpy(&msg[1], src, bytes).

Patch applied, thanks.

Cheers,
Samuel.

Signature · 2 lines
Intel Open Source Technology Centre
http://oss.intel.com/