diff options
| author | Daniel Kurtz <djkurtz@chromium.org> | 2012-05-09 01:38:52 -0400 |
|---|---|---|
| committer | Dmitry Torokhov <dmitry.torokhov@gmail.com> | 2012-05-10 23:39:05 -0400 |
| commit | d1ff320f0a9766a53ae412d96f72bd861a889af6 (patch) | |
| tree | dc60b58f939dadf51d53e5051f5db465049a1523 /drivers/input/touchscreen | |
| parent | 71b3e938cb97f6cf324fb5aaca46d8e400dc38f0 (diff) | |
Input: atmel_mxt_ts - verify object size in mxt_write_object
Don't allow writing past the length of an object.
Signed-off-by: Daniel Kurtz <djkurtz@chromium.org>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
Diffstat (limited to 'drivers/input/touchscreen')
| -rw-r--r-- | drivers/input/touchscreen/atmel_mxt_ts.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c index 15ae6fd575b2..8f0dc7776e7d 100644 --- a/drivers/input/touchscreen/atmel_mxt_ts.c +++ b/drivers/input/touchscreen/atmel_mxt_ts.c | |||
| @@ -506,7 +506,7 @@ static int mxt_write_object(struct mxt_data *data, | |||
| 506 | u16 reg; | 506 | u16 reg; |
| 507 | 507 | ||
| 508 | object = mxt_get_object(data, type); | 508 | object = mxt_get_object(data, type); |
| 509 | if (!object) | 509 | if (!object || offset >= object->size + 1) |
| 510 | return -EINVAL; | 510 | return -EINVAL; |
| 511 | 511 | ||
| 512 | reg = object->start_address; | 512 | reg = object->start_address; |