690b2549b1
The "data->block[0]" variable comes from the user and is a number
between 0-255. It needs to be capped to prevent writing beyond the end
of dma_buffer[].
Fixes: 5e9a97b1f449 ("i2c: ismt: Adding support for I2C_SMBUS_BLOCK_PROC_CALL")
Reported-and-tested-by: Zheyu Ma <zheyuma97@gmail.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
||
|---|---|---|
| .. | ||
| algos | ||
| busses | ||
| muxes | ||
| i2c-boardinfo.c | ||
| i2c-core-acpi.c | ||
| i2c-core-base.c | ||
| i2c-core-of.c | ||
| i2c-core-slave.c | ||
| i2c-core-smbus.c | ||
| i2c-core.h | ||
| i2c-dev.c | ||
| i2c-mux.c | ||
| i2c-slave-eeprom.c | ||
| i2c-slave-testunit.c | ||
| i2c-smbus.c | ||
| i2c-stub.c | ||
| Kconfig | ||
| Makefile | ||