lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Input: atmel_mxt_ts - verify object size in mxt_write_object

Browse Source 
Don't allow writing past the length of an object.

Signed-off-by: Daniel Kurtz <djkurtz@chromium.org>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
This commit is contained in:
Daniel Kurtz
2012-05-08 22:38:52 -07:00
committed by Dmitry Torokhov
parent 71b3e938cb
commit d1ff320f0a
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/input/touchscreen/atmel_mxt_ts.c
View File

@@ -506,7 +506,7 @@ static int mxt_write_object(struct mxt_data *data,
u16 reg; u16 reg;
object = mxt_get_object(data, type); object = mxt_get_object(data, type);
if (!object) if (!object || offset >= object->size + 1)
return -EINVAL; return -EINVAL;
reg = object->start_address; reg = object->start_address;