mfd: Fix off-by-one value range checking for tps65912_i2c_write

Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

kernel os linux

If bytes == (TPS6591X_MAX_REGISTER + 1), we have a buffer overflow when
doing memcpy(&msg[1], src, bytes).

Signed-off-by: Axel Lin <axel.lin@gmail.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

authored by

Axel Lin and committed by

Samuel Ortiz 14 years ago 63c8a58d a5e06781

+1 -1

1 changed file

expand all

drivers

mfd

tps65912-i2c.c

+1 -1

drivers/mfd/tps65912-i2c.c

··· 57 57 u8 msg[TPS6591X_MAX_REGISTER + 1]; 58 58 int ret; 59 59 60 - if (bytes > (TPS6591X_MAX_REGISTER + 1)) 60 + if (bytes > TPS6591X_MAX_REGISTER) 61 61 return -EINVAL; 62 62 63 63 msg[0] = reg;