projects / GitHub / moto-9609 / android_kernel_motorola_exynos9610.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: 71b3e93)
Input: atmel_mxt_ts - verify object size in mxt_write_object
authorDaniel Kurtz <djkurtz@chromium.org>
Wed, 9 May 2012 05:38:52 +0000 (22:38 -0700)
committerDmitry Torokhov <dmitry.torokhov@gmail.com>
Fri, 11 May 2012 03:39:05 +0000 (20:39 -0700)
Don't allow writing past the length of an object.

Signed-off-by: Daniel Kurtz <djkurtz@chromium.org>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
drivers/input/touchscreen/atmel_mxt_ts.c patch | blob | blame | history

diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c
index 15ae6fd575b2ba1a472648206b58af108ff0759b..8f0dc7776e7da7f3673e82bd9a0a214cfb756ba2 100644 (file)
--- a/drivers/input/touchscreen/atmel_mxt_ts.c
+++ b/drivers/input/touchscreen/atmel_mxt_ts.c
@@ -506,7 +506,7 @@ static int mxt_write_object(struct mxt_data *data,
        u16 reg;
 
        object = mxt_get_object(data, type);
-       if (!object)
+       if (!object || offset >= object->size + 1)
                return -EINVAL;
 
        reg = object->start_address;