dect
/
linux-2.6
Archived
13
0
Fork 0
Code Releases Activity

Input: atmel_mxt_ts - verify object size in mxt_write_object 

Don't allow writing past the length of an object.

Signed-off-by: Daniel Kurtz <djkurtz@chromium.org>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
This commit is contained in:
Daniel Kurtz 2012-05-08 22:38:52 -07:00 committed by Dmitry Torokhov
parent 71b3e938cb
commit d1ff320f0a
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/input/touchscreen/atmel_mxt_ts.c
View File

@ -506,7 +506,7 @@ static int mxt_write_object(struct mxt_data *data,
u16 reg;
object = mxt_get_object(data, type);
if (!object)
if (!object || offset >= object->size + 1)
return -EINVAL;
reg = object->start_address;