mfd: Fix off-by-one value range checking for tps6507x

Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

kernel os linux

If bytes == (TPS6507X_MAX_REGISTER + 1), we have a buffer overflow when
doing memcpy(&msg[1], src, bytes).

Signed-off-by: Axel Lin <axel.lin@gmail.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

authored by

Axel Lin and committed by

Samuel Ortiz 15 years ago a8d6aa08 7745cc8c

+1 -1

1 changed file

expand all

drivers

mfd

tps6507x.c

+1 -1

drivers/mfd/tps6507x.c

··· 68 68 u8 msg[TPS6507X_MAX_REGISTER + 1]; 69 69 int ret; 70 70 71 - if (bytes > (TPS6507X_MAX_REGISTER + 1)) 71 + if (bytes > TPS6507X_MAX_REGISTER) 72 72 return -EINVAL; 73 73 74 74 msg[0] = reg;