| commit | 0514e9acd7655c708fbf12a659ea43d835bc688a | |
| author | Axel Lin <axel.lin@gmail.com> | |
| Mon, 16 May 2011 14:19:01 +0000 (16 22:19 +0800) | ||
| committer | Liam Girdwood <lrg@slimlogic.co.uk> | |
| Fri, 27 May 2011 09:49:09 +0000 (27 10:49 +0100) | ||
| tree | 5f9ecf1224773a0ca671d8d516c507d133cbf2f1 | treesnapshot (tar.gz zip) |
| parent | 4aa922c024b2a194d7b68b22a66dfcf86e7838b3 | commitdiff |
mfd: Fix off-by-one value range checking for tps65910_i2c_write
If bytes == (TPS65910_MAX_REGISTER + 1), we have a buffer overflow when
doing memcpy(&msg[1], src, bytes).
Signed-off-by: Axel Lin <axel.lin@gmail.com>
Acked-by: Samuel Ortiz <sameo@linux.intel.com>
Signed-off-by: Liam Girdwood <lrg@slimlogic.co.uk>
If bytes == (TPS65910_MAX_REGISTER + 1), we have a buffer overflow when
doing memcpy(&msg[1], src, bytes).
Signed-off-by: Axel Lin <axel.lin@gmail.com>
Acked-by: Samuel Ortiz <sameo@linux.intel.com>
Signed-off-by: Liam Girdwood <lrg@slimlogic.co.uk>
| drivers/mfd/tps65910.c | diffblobblamehistory |