diff options
| author | Daniel Kurtz <djkurtz@chromium.org> | 2012-05-08 22:38:52 -0700 |
|---|---|---|
| committer | Dmitry Torokhov <dmitry.torokhov@gmail.com> | 2012-05-10 20:39:05 -0700 |
| commit | d1ff320f0a9766a53ae412d96f72bd861a889af6 (patch) | |
| tree | dc60b58f939dadf51d53e5051f5db465049a1523 /drivers/input | |
| parent | 71b3e938cb97f6cf324fb5aaca46d8e400dc38f0 (diff) | |
Input: atmel_mxt_ts - verify object size in mxt_write_object
Don't allow writing past the length of an object.
Signed-off-by: Daniel Kurtz <djkurtz@chromium.org>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
Diffstat (limited to 'drivers/input')
| -rw-r--r-- | drivers/input/touchscreen/atmel_mxt_ts.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c index 15ae6fd575b2..8f0dc7776e7d 100644 --- a/drivers/input/touchscreen/atmel_mxt_ts.c +++ b/drivers/input/touchscreen/atmel_mxt_ts.c @@ -506,7 +506,7 @@ static int mxt_write_object(struct mxt_data *data, u16 reg; object = mxt_get_object(data, type); - if (!object) + if (!object || offset >= object->size + 1) return -EINVAL; reg = object->start_address; |