Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d1ff320f authored by Daniel Kurtz's avatar Daniel Kurtz Committed by Dmitry Torokhov
Browse files

Input: atmel_mxt_ts - verify object size in mxt_write_object 



Don't allow writing past the length of an object.

Signed-off-by: default avatarDaniel Kurtz <djkurtz@chromium.org>
Signed-off-by: default avatarDmitry Torokhov <dtor@mail.ru>
parent 71b3e938

drivers/input/touchscreen/atmel_mxt_ts.c

+1 −1
Original line number Original line Diff line number Diff line
@@ -506,7 +506,7 @@ static int mxt_write_object(struct mxt_data *data, 
	u16 reg;

	u16 reg;





	object = mxt_get_object(data, type);

	object = mxt_get_object(data, type);

	if (!object)

	if (!object || offset >= object->size + 1)

		return -EINVAL;

		return -EINVAL;





	reg = object->start_address;

	reg = object->start_address;