diff options
| author | Axel Lin <axel.lin@gmail.com> | 2011-05-16 22:19:01 +0800 |
|---|---|---|
| committer | Liam Girdwood <lrg@slimlogic.co.uk> | 2011-05-27 10:49:09 +0100 |
| commit | 0514e9acd7655c708fbf12a659ea43d835bc688a (patch) | |
| tree | 5f9ecf1224773a0ca671d8d516c507d133cbf2f1 /drivers/mfd | |
| parent | 4aa922c024b2a194d7b68b22a66dfcf86e7838b3 (diff) | |
mfd: Fix off-by-one value range checking for tps65910_i2c_write
If bytes == (TPS65910_MAX_REGISTER + 1), we have a buffer overflow when
doing memcpy(&msg[1], src, bytes).
Signed-off-by: Axel Lin <axel.lin@gmail.com>
Acked-by: Samuel Ortiz <sameo@linux.intel.com>
Signed-off-by: Liam Girdwood <lrg@slimlogic.co.uk>
Diffstat (limited to 'drivers/mfd')
| -rw-r--r-- | drivers/mfd/tps65910.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/mfd/tps65910.c b/drivers/mfd/tps65910.c index bf649cf6a0ae..e31824870b9f 100644 --- a/drivers/mfd/tps65910.c +++ b/drivers/mfd/tps65910.c @@ -71,7 +71,7 @@ static int tps65910_i2c_write(struct tps65910 *tps65910, u8 reg, u8 msg[TPS65910_MAX_REGISTER + 1]; int ret; - if (bytes > (TPS65910_MAX_REGISTER + 1)) + if (bytes > TPS65910_MAX_REGISTER) return -EINVAL; msg[0] = reg; |