diff options
| author | Seung-Woo Kim <sw0312.kim@samsung.com> | 2014-12-02 21:48:24 +0900 |
|---|---|---|
| committer | Seung-Woo Kim <sw0312.kim@samsung.com> | 2014-12-02 21:56:32 +0900 |
| commit | 317ece5de9f6aca9089f5b054a2e09000d558f8a (patch) | |
| tree | 6f57305cd84b9f199dcff477cc2aa1ec09eacedb /drivers | |
| parent | 687e6ad9f5edd1c91a75532d4996bcb613a85f29 (diff) | |
| download | linux-3.10-317ece5de9f6aca9089f5b054a2e09000d558f8a.tar.gz linux-3.10-317ece5de9f6aca9089f5b054a2e09000d558f8a.tar.bz2 linux-3.10-317ece5de9f6aca9089f5b054a2e09000d558f8a.zip | |
input: touchscreen: mms128: fix allocation size for conf data
The data in config_fw has header, data blocks and end block. The
data count in the config_fw is the number of data blocks except
end block. Without considering end block, this causes buffer
overflow. So this patch fixes allocation size considering end block.
Change-Id: I053e251a21ba8befb03a1db233e4e2d9dbf1b795
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/input/touchscreen/mms128.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/input/touchscreen/mms128.c b/drivers/input/touchscreen/mms128.c index 7bcb3ba62e8..24248f428ed 100644 --- a/drivers/input/touchscreen/mms128.c +++ b/drivers/input/touchscreen/mms128.c @@ -474,7 +474,8 @@ static void mms_config_set(void *context) } offset = conf_hdr->data_offset; - conf_item = kzalloc(sizeof(*conf_item)*conf_hdr->data_count,GFP_KERNEL); + conf_item = kzalloc(sizeof(*conf_item) * (conf_hdr->data_count + 1), + GFP_KERNEL); for (i=0 ;; i++ , offset += MMS_MFSP_OFFSET) { |