summaryrefslogtreecommitdiff
path: root/drivers/input
diff options
context:
space:
mode:
authorDaniel Kurtz <djkurtz@chromium.org>2012-05-08 22:38:52 -0700
committerDmitry Torokhov <dmitry.torokhov@gmail.com>2012-05-10 20:39:05 -0700
commitd1ff320f0a9766a53ae412d96f72bd861a889af6 (patch)
treedc60b58f939dadf51d53e5051f5db465049a1523 /drivers/input
parent71b3e938cb97f6cf324fb5aaca46d8e400dc38f0 (diff)
downloadlinux-3.10-d1ff320f0a9766a53ae412d96f72bd861a889af6.tar.gz
linux-3.10-d1ff320f0a9766a53ae412d96f72bd861a889af6.tar.bz2
linux-3.10-d1ff320f0a9766a53ae412d96f72bd861a889af6.zip
Input: atmel_mxt_ts - verify object size in mxt_write_object
Don't allow writing past the length of an object. Signed-off-by: Daniel Kurtz <djkurtz@chromium.org> Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
Diffstat (limited to 'drivers/input')
-rw-r--r--drivers/input/touchscreen/atmel_mxt_ts.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c
index 15ae6fd575b..8f0dc7776e7 100644
--- a/drivers/input/touchscreen/atmel_mxt_ts.c
+++ b/drivers/input/touchscreen/atmel_mxt_ts.c
@@ -506,7 +506,7 @@ static int mxt_write_object(struct mxt_data *data,
u16 reg;
object = mxt_get_object(data, type);
- if (!object)
+ if (!object || offset >= object->size + 1)
return -EINVAL;
reg = object->start_address;