Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d1ff320f authored by Daniel Kurtz's avatar Daniel Kurtz Committed by Dmitry Torokhov
Browse files

Input: atmel_mxt_ts - verify object size in mxt_write_object



Don't allow writing past the length of an object.

Signed-off-by: default avatarDaniel Kurtz <djkurtz@chromium.org>
Signed-off-by: default avatarDmitry Torokhov <dtor@mail.ru>
parent 71b3e938
Loading
Loading
Loading
Loading
+1 −1
Original line number Original line Diff line number Diff line
@@ -506,7 +506,7 @@ static int mxt_write_object(struct mxt_data *data,
	u16 reg;
	u16 reg;


	object = mxt_get_object(data, type);
	object = mxt_get_object(data, type);
	if (!object)
	if (!object || offset >= object->size + 1)
		return -EINVAL;
		return -EINVAL;


	reg = object->start_address;
	reg = object->start_address;