diff options
| author | Seung-Woo Kim <sw0312.kim@samsung.com> | 2014-12-02 22:35:48 +0900 |
|---|---|---|
| committer | Chanho Park <chanho61.park@samsung.com> | 2014-12-03 16:27:52 +0900 |
| commit | 845f232c0f0693a0641e1669762327731477edde (patch) | |
| tree | c3fa54e7ee80c2b3c26db4ad4ab07530b33223d9 | |
| parent | 317ece5de9f6aca9089f5b054a2e09000d558f8a (diff) | |
| download | linux-3.10-845f232c0f0693a0641e1669762327731477edde.tar.gz linux-3.10-845f232c0f0693a0641e1669762327731477edde.tar.bz2 linux-3.10-845f232c0f0693a0641e1669762327731477edde.zip | |
sensorhub: Add size check before setting message
User can send wrong message size, so before setting message value,
the size should be checked to prevent buffer overflow.
Change-Id: Ia3ebdbd45b357054b6fad05c7f251a0b770172db
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
| -rw-r--r-- | drivers/sensorhub/stm/ssp_spi.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/sensorhub/stm/ssp_spi.c b/drivers/sensorhub/stm/ssp_spi.c index d6c33a169e6..c883f83a1f9 100644 --- a/drivers/sensorhub/stm/ssp_spi.c +++ b/drivers/sensorhub/stm/ssp_spi.c @@ -342,7 +342,7 @@ int send_instruction(struct ssp_data *data, u8 uInst, msg->buffer[0] = uSensorType; memcpy(&msg->buffer[1], uSendBuf, uLength); - if (uSensorType == BIO_HRM_RAW_FAC) + if (uSensorType == BIO_HRM_RAW_FAC && (uLength > 8)) msg->buffer[10] = 1; ssp_dbg("Inst = 0x%x, Sensor Type = 0x%x, data = %u\n", |